davids52/cve-2021-29447_auto-scriptThis repo describes about cve-2021-29447 and a small script for exploiting automatically
This repository details the CVE-2021-29447 vulnerability, a critical security flaw in WordPress that allowed for authenticated XML External Entity (XXE) attacks through the Media Library. It also provides an automatic script that demonstrates the proof of concept (PoC).
The vulnerability existed in WordPress's processing of metadata within uploaded audio files. Specifically:
Root Cause: WordPress uses the getID3 library to parse metadata from media files like WAV files. A WAV file can contain a chunk of XML data called iXML. Attackers could craft a malicious WAV file with XML content that, when parsed by the vulnerable library, triggers an XXE attack.
Affected Versions: WordPress versions 5.6 to 5.7.
Key Requirement: The WordPress installation must be running on PHP 8, as changes in PHP 8's default Libxml2 configuration were central to the exploit.
Impact: Successful exploitation could lead to arbitrary file disclosure (e.g., reading wp-config.php to obtain database credentials) and Server-Side Request Forgery (SSRF)
Below is the code snippet which try to parse XML data in iXML subchunk:
Automates the entire process: Creates the malicious WAV file and DTD, handles file upload to the target WordPress site, and sets up a listener to receive exfiltrated data.
Configurable: Allows you to specify the target file path for exfiltration.
./payload.sh