Summary
@offactory/compress-fonts contains an OS command injection flaw in its font-processing workflow. When a crafted font filename is incorporated into a FontForge command without shell-safe quoting, an attacker who can supply or influence font files may execute commands with the privileges of the Node.js process.
@offactory/compress-fonts contains an OS command injection flaw in its font-processing workflow. When a crafted font filename is incorporated into a FontForge command without shell-safe quoting, an attacker who can supply or influence font files may execute commands with the privileges of the Node.js process.
Affected context
The vulnerability occurs in deployments that use @offactory/compress-fonts to process font files and pass their paths to FontForge through a shell command. Risk increases when untrusted users, uploads, build inputs, or automated pipelines can introduce files whose names are later processed by the package.
The vulnerability occurs in deployments that use @offactory/compress-fonts to process font files and pass their paths to FontForge through a shell command. Risk increases when untrusted users, uploads, build inputs, or automated pipelines can introduce files whose names are later processed by the package.
Exploit preconditions
- Attack surface: Font-processing functionality that invokes FontForge through a shell.
- Required access: Ability to supply or influence a font file and its filename in the processing workflow.
- Trigger point: Construction and execution of the FontForge command through Node.js child_process.execSync.
- Why exploitation is possible: Font paths are interpolated without shell-safe quoting, allowing shell metacharacters in filenames to alter command interpretation.
- Attack surface: Font-processing functionality that invokes FontForge through a shell.
- Required access: Ability to supply or influence a font file and its filename in the processing workflow.
- Trigger point: Construction and execution of the FontForge command through Node.js child_process.execSync.
- Why exploitation is possible: Font paths are interpolated without shell-safe quoting, allowing shell metacharacters in filenames to alter command interpretation.
Why this happens
The underlying flaw is the construction of a shell command by concatenating or interpolating externally influenced file paths. Passing that command to a shell-enabled execution API allows filename data to be interpreted as shell syntax rather than as a literal argument. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
The underlying flaw is the construction of a shell command by concatenating or interpolating externally influenced file paths. Passing that command to a shell-enabled execution API allows filename data to be interpreted as shell syntax rather than as a literal argument. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- An attacker may execute arbitrary operating-system commands.
- The Node.js process and its accessible files or credentials could be compromised.
- Build, conversion, or processing environments could be altered.
- Sensitive data may be exposed or modified.
- Downstream systems could be affected if processed artifacts or pipeline credentials are trusted.
- An attacker may execute arbitrary operating-system commands.
- The Node.js process and its accessible files or credentials could be compromised.
- Build, conversion, or processing environments could be altered.
- Sensitive data may be exposed or modified.
- Downstream systems could be affected if processed artifacts or pipeline credentials are trusted.
General mitigation guidance
Mitigation generally focuses on eliminating shell interpretation and reducing trust in file metadata.
Common defensive patterns include:
- Prefer direct process-spawn APIs that pass arguments as an array without invoking a shell.
- Treat filenames and paths as data, not command fragments, and apply platform-appropriate argument handling.
- Validate filenames against an allowlist of expected characters and reject unexpected path components.
- Isolate font conversion in a low-privilege process or container with restricted filesystem, network, and credential access.
- Use controlled temporary directories and prevent access to sensitive host paths.
- Keep dependency and artifact pipelines governed by provenance checks and controlled upload policies.
Mitigation generally focuses on eliminating shell interpretation and reducing trust in file metadata.
Common defensive patterns include:
- Prefer direct process-spawn APIs that pass arguments as an array without invoking a shell.
- Treat filenames and paths as data, not command fragments, and apply platform-appropriate argument handling.
- Validate filenames against an allowlist of expected characters and reject unexpected path components.
- Isolate font conversion in a low-privilege process or container with restricted filesystem, network, and credential access.
- Use controlled temporary directories and prevent access to sensitive host paths.
- Keep dependency and artifact pipelines governed by provenance checks and controlled upload policies.
How teams detect issues like this
Detection can combine source review, dependency analysis, and runtime monitoring:
- Use static analysis rules to identify string interpolation or concatenation passed to
execSync, shell execution, or comparable APIs. - Review code for external filenames flowing into command construction without argument-array handling or validation.
- Enforce policies that prohibit shell invocation for file-processing operations unless explicitly justified.
- Monitor process creation from font-processing workers and alert on unexpected child processes or command interpreters.
- Add CI checks for command-injection patterns and automated dependency review; neutral automated review tools may help identify unsafe execution flows.
Detection can combine source review, dependency analysis, and runtime monitoring:
- Use static analysis rules to identify string interpolation or concatenation passed to
execSync, shell execution, or comparable APIs. - Review code for external filenames flowing into command construction without argument-array handling or validation.
- Enforce policies that prohibit shell invocation for file-processing operations unless explicitly justified.
- Monitor process creation from font-processing workers and alert on unexpected child processes or command interpreters.
- Add CI checks for command-injection patterns and automated dependency review; neutral automated review tools may help identify unsafe execution flows.
