CVE-2024-2961 (CNEXT) XXE Channel Adaptation Exploit Script

Adapts the PHP file-read -> RCE exploit script from Ambionics' official cnext-exploits to the SVG upload + XXE arbitrary file read scenario (PolarisCTF 2026 "Avatar Uploader" type challenges).

Prerequisites

• Target: Linux + glibc < 2.39 (Ubuntu 20.04 requires < 2.31-0ubuntu9.15, fixed in USN-6737-1) + PHP (tested working on PHP 7.3)
• Read primitive: Able to make PHP read an arbitrary path via XXE / LFI, and supports php://filter, data://, zlib (the script's check_vulnerable() will verify automatically)
• Local: Python 3.10+, pip install -r requirements.txt (pwntools, ten, requests)

Differences from the Original (Adaptation Points)

1. Remote class rewritten: Translates "make PHP read a path" into the challenge's XXE round-trip: upload an SVG containing an external entity -> update avatar_name -> request the parsing endpoint to echo back.
2. Filter separator | -> /: When the XML entity URL contains |, libxml fails to parse (tested: DOMDocument returns an empty document); php://filter supports bare filters without a prefix separated by /, equivalent to read=a|b|c.
3. LIBC_FILE changed to a relative path (runs on both Windows/Linux).
4. download_file changed to use open() for writing (the Path exported by the ten library is a PosixPath subclass, which cannot be instantiated on Windows).

Usage

1. Edit the Remote class at the top of the script: fill in the challenge API address, account, and password.
2. Translate the target read primitive into Remote.send/download (the example implementation targets the "upload SVG + parse on view" interface form; adapt similarly for other forms).
3. Run (the command produces no echo; use redirection to write a file and read it back, or use -s sleep timing to verify):

python cnext-exploit-xxe-polaris.py <url> '/readflag > /var/www/html/uploads/flag_out.txt' -s 2

After seeing EXPLOIT SUCCESS, use the read primitive to read the output file back.

Notes

• For CTF competitions and security research in authorized environments only.
• Upstream: https://github.com/ambionics/cnext-exploits (Charles Fol @cfreal_, Ambionics/LEXFO)
• Vulnerability: CVE-2024-2961 (glibc iconv ISO-2022-CN-EXT out-of-bounds write), advisory GLIBC-SA-2024-0004; technical analysis: https://www.ambionics.io/blog/iconv-cve-2024-2961-p1