## https://sploitus.com/exploit?id=DF7C385B-AC64-5D12-8CDC-962262B9209E
# CVE-2024-2961 (CNEXT) XXE Channel Adaptation for Exploit Script
This script adapts the PHP file from Ambionics’ official `cnext-exploits` to exploit the **SVG upload + XXE arbitrary file reading** scenario (similar to PolarisCTF 2026 “avatar uploader” challenge).
## Prerequisites
1. **Target**: Linux with glibc. Update `avatar_name` to direct the request to a parsing interface.
2. **Filter separator change**: From `|` to `/`. When XML entities contain `|`, libxml fails to parse them (observed with DOMDocument returning an empty document). `php://filter` supports bare filters separated by `/`, equivalent to `read=a|b|c`.
3. Change `LIBC_FILE` to a relative path (works on both Windows and Linux).
4. Use `open()` for writing instead of `download_file` (the Path exported by the ten library is a PosixPath subclass, which cannot be instantiated on Windows).
## Usage
1. Edit the `Remote` class at the beginning of the script: fill in the challenge’s API address, username, and password.
2. Replace the target read primitive with `Remote.send/download`. The example implementation targets the interface where “SVG upload + parsing during viewing” occurs; other implementations can be copied accordingly.
3. Run the script (no output is displayed; redirect the output to a file for further processing, or use `-s` for timing verification):
```bash
python cnext-exploit-xxe-polaris.py '/readflag > /var/www/html/uploads/flag_out.txt' -s 2
```
After seeing “EXPLOIT SUCCESS”, use the read primitive to read the output file back.
## Notes
- This tool is intended only for CTF competitions and authorized security research.
- Source: https://github.com/ambionics/cnext-exploits (Charles Fol @cfreal_, Ambionics/LEXFO)
- Vulnerability: CVE-2024-2961 (glibc iconv ISO-2022-CN-EXT out-of-bounds write); announcement: GLIBC-SA-2024-0004; analysis: https://www.ambionics.io/blog/iconv-cve-2024-2961-p1