CVE-2025-63708
📋 TL;DR
A Cross-Site Scripting (XSS) vulnerability in SourceCodester AI Font Matcher allows attackers to inject malicious JavaScript through font family names in webfonts API requests. This enables session cookie theft, account hijacking, and unauthorized actions on behalf of authenticated users. Anyone using the vulnerable AI Font Matcher software is affected.
💻 Affected Systems
- SourceCodester AI Font Matcher
📦 What is this software?
Ai Font Matcher by Remyandrade
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, session hijacking, data theft, and unauthorized administrative actions performed on behalf of authenticated users.
Likely Case
Session cookie theft leading to account compromise and unauthorized access to user data.
If Mitigated
Limited impact with proper input validation and output encoding in place.
🎯 Exploit Status
Exploitation involves intercepting fetch requests to webfonts endpoint and injecting malicious JavaScript payloads through font family names.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html
Restart Required: No
Instructions:
No official patch available. Implement input validation and output encoding for font family names in webfonts API.
🔧 Temporary Workarounds
Implement Input Validation
allAdd server-side validation to sanitize font family names before processing.
// JavaScript example: const sanitizedFontName = fontName.replace(/[<>"']/g, '')
Content Security Policy
allImplement CSP headers to restrict script execution from untrusted sources.
Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Disable or restrict access to the webfonts API endpoint
- Implement WAF rules to block suspicious font family name patterns
🔍 How to Verify
Check if Vulnerable:
Test by injecting script payloads into font family name parameters in webfonts API requests and checking if they execute.Check Version:
Check software version in application interface or configuration files.Verify Fix Applied:
Verify that script payloads in font family names are properly sanitized and do not execute in browser.📡 Detection & Monitoring
Log Indicators:
- Unusual font family names containing script tags or JavaScript code in webfonts API logs
Network Indicators:
- HTTP requests to webfonts endpoint with suspicious parameters containing script payloads
SIEM Query:
source="webfonts_api" AND (param="font_family" AND value CONTAINS "<script>" OR value CONTAINS "javascript:")