CVE-2021-29447 PoC — WordPress Authenticated XXE attack when installation is running PHP 8

Readme

# WordPress XXE Vulnerability : CVE-2021-29447

A user with the ability to upload a malicious WAVE file (like an Author) can exploit an XML parsing issue in the Media Library in WordPress leading to XXE attacks and that could lead to file system disclosure

#  Vulnerable code

XML External Entity (XXE) Vulnerabilities

XML offers the possibility to define custom entities that can be reused throughout a document. This can, for example, be used to avoid duplication. 
The following code defines an entity myEntity for further usage.

![1](https://user-images.githubusercontent.com/64151982/202497991-87be7229-0348-4a5a-a4ea-ce1edc3ac440.PNG)

The value of defined entities can also stem from an external source referenced by a URI. In this case, they are called external entities:

![2](https://user-images.githubusercontent.com/64151982/202499012-872eb4c6-aae8-42bc-995d-755726650e26.PNG)

XXE attacks misuse this feature. if an attacker would supply file:///var/www/wp-config.php as the URI, he would successfully leak sensitive file content. and the attack are possible when a loosely configured XML parser is run on user-controlled content. 

XXE in WordPress

WordPress has a Media Library that enables authenticated users to upload media files that can then be used in their blog posts. 
To extract meta information from these media files, e.g., artist name or title, WordPress uses the getID3 library. Some of this 
metadata is parsed in XML form. Here, it was reported a possible XXE vulnerability (line 730).

![14](https://user-images.githubusercontent.com/64151982/202934383-14720710-4266-438f-8f8a-9d425240af3c.PNG)

libxml_disable_entity_loader(true) function was deprecated because PHP 8 versions use Libxml2 v2.9+ which disables external entity fetching by default.

# Exploitation

Create a malicious WAVE file using following command

![4](https://user-images.githubusercontent.com/64151982/202817877-0a85cfeb-a1a6-487f-80e6-9f7705daa154.PNG)

Create a dtd file and then add this code, this will allow you to retrieved the wp-config.php which contains sensitive data such as database credentials.

![5](https://user-images.githubusercontent.com/64151982/202819386-8b42c035-a4b9-4e91-8547-8e28e9dce5b7.PNG)

Now launch an http server 

![6](https://user-images.githubusercontent.com/64151982/202820687-d8855214-78f8-4c64-87d8-873ad547ccf2.PNG)

Upload the malicious .wav to the WordPress application. Once you've uploaded the .wav file, you should see the following request in your HTTP server logs. Note, in order to exfiltrate data effectively use Zlib for decoding. 

![8](https://user-images.githubusercontent.com/64151982/202821938-89fd075c-45ab-4d09-9299-48bbc3876b2d.PNG)

After that you will get the database credentials, login to the database and try to find the administrator 

![9](https://user-images.githubusercontent.com/64151982/202822426-5bd8b36e-ccdb-433f-9e6f-3b5a9e8eff23.PNG)

corp-001 is the administrator crack his password hash and then login an as administrator

![11](https://user-images.githubusercontent.com/64151982/202823277-aa31eecd-3b15-495d-8be6-173fefb528d4.PNG)



# Fix code

WordPress patched the vulnerability in version 5.7.1 by reintroducing the call to the libxml_disable_entity_loader() function that was deprecated in PHP 8. To avoid PHP deprecation warnings, the PHP error suppressing operator @ was added to the call.

![12](https://user-images.githubusercontent.com/64151982/202830716-dbfbb757-ad65-4790-9862-7c10f64d4403.PNG)

# Resources:

https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/
<br />
https://nvd.nist.gov/vuln/detail/CVE-2021-29447
<br />
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29447
<br />
https://github.com/motikan2010/CVE-2021-29447
<br />
https://www.youtube.com/watch?v=pkooNXGHl7c
<br />
https://www.youtube.com/watch?v=tE8Smz1Jvb8
<br />
https://www.mend.io/vulnerability-database/CVE-2021-29447

File Snapshot

Remarks