An investigation by Canva deep dive into the world of font security has uncovered three unexpected vulnerabilities and revealed how choosing the wrong font could spell out a cybersecurity disaster.
In an effort to enhance the security of its tools, Canva has been researching lessexplored attack surfaces, including fonts, which play an integral part in graphics processing.
A trio of vulnerabilities have been highlighted in a report entitled “Fonts are still a Helvetica of a Problem”, with Canva ultimately declaring that the font landscape is actually quite rich in attack surfaces.
Canva is concerned about the font you use
The first vulnerability, tracked as CVE202345139, was discovered in FontTools, a Python library for manipulating fonts. Canva found that when processing an SVG table to subset a font, FontTools could use an untrusted XML file, leading to an XML External Entity (XXE) vulnerability.
The researchers abused this vulnerability to produce a subsetted font containing an SVG table with an /etc/passwd payload. FontTools released a patch three days after being notified of the vulnerability in September 2023.
The other two vulnerabilities, CVE202425081 and CVE202425082, both rated at 4.2/10, were associated with naming conventions and font compression. Canva found the potential for command injection when dealing with filenames in tools like FontForge and ImageMagick. Both have also been addressed.
Acknowledging the timely work of opensource font software and tool maintainers, Canva noted that IT workers should “treat fonts like any other untrusted input” by implementing sandboxing and using tools like OpenTypeSanitizer.