CVE-2024-2961 PoC — GNU C Library 安全漏洞

Description

Exploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv()

介绍

# CNEXT exploits

Exploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv(), by [@cfreal_](https://twitter.com/cfreal_)

# Technical analysis

The vulnerability and exploits are described in the following blogposts:

- [Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (part 1)](https://www.ambionics.io/blog/iconv-cve-2024-2961-p1): PHP filters
- [Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (part 2)](https://www.ambionics.io/blog/iconv-cve-2024-2961-p2): direct `iconv()` calls, Roundcube
- To be continued...

# Exploits

Exploits will become available as blogposts come out.

- [CNEXT: file read to RCE exploit](cnext-exploit.py)
- [Roundcube: authenticated RCE exploit](roundcube-exploit.py)
- To be continued...

文件快照

备注