CVE-2021-21707: PHP XXE Vulnerability in XML Parsing

CVE-2021-21707 Overview

CVE-2021-21707 is an input validation vulnerability in PHP that affects certain XML parsing functions, including simplexml_load_file(). The vulnerability arises because these functions URL-decode the filename parameter passed to them. When a filename contains a URL-encoded NUL character (%00), the function interprets this as the end of the filename string, causing it to read a different file than the user intended. This path traversal issue can lead to unintended information disclosure.

Critical Impact

Attackers can manipulate file paths using URL-encoded NUL characters to access files outside the intended directory scope, potentially exposing sensitive configuration files or application data.

Affected Products

• PHP versions 7.3.x below 7.3.33
• PHP versions 7.4.x below 7.4.26
• PHP versions 8.0.x below 8.0.13
• NetApp Clustered Data ONTAP
• Debian Linux 10.0 and 11.0
• Tenable.sc

Discovery Timeline

• 2021-11-29 - CVE-2021-21707 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-21707

Vulnerability Analysis

This vulnerability stems from improper input validation in PHP's XML parsing functions. Functions such as simplexml_load_file(), which are commonly used to load and parse XML documents from files, automatically URL-decode the filename parameter before processing. This behavior becomes problematic when attackers inject URL-encoded NUL characters (%00) into the filename string.

When the NUL character is decoded, PHP's internal string handling treats it as a string terminator. This causes the function to truncate the filename at the NUL character position, effectively allowing an attacker to manipulate which file gets read. For example, a filename like /var/www/data/user.xml%00.png would be interpreted as /var/www/data/user.xml, bypassing file extension restrictions or accessing unintended files.

The vulnerability is classified under CWE-159 (Improper Handling of Invalid Use of Special Elements), reflecting the core issue of failing to properly sanitize special characters in user-controlled input.

Root Cause

The root cause lies in the URL-decoding logic applied to filename parameters before they are passed to the underlying file system operations. PHP's XML parsing functions perform this decoding step without validating or sanitizing the resulting string for NUL characters. This creates a disconnect between the user's intended filename and the actual file path resolved by the system, as NUL bytes serve as string terminators in C-based implementations.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by crafting HTTP requests or API calls that pass malicious filenames to vulnerable PHP applications. The attack requires that the target application use affected XML parsing functions with user-controllable filename inputs.

A typical exploitation scenario involves:

1. Identifying a PHP application that accepts user input for XML file processing
2. Injecting a filename containing URL-encoded NUL characters (e.g., target.xml%00ignored.txt)
3. The XML parsing function URL-decodes the input and truncates at the NUL byte
4. The application reads an unintended file, potentially exposing sensitive data

Applications that validate file extensions before passing filenames to XML functions are particularly vulnerable, as the NUL byte injection can bypass these checks while still allowing access to arbitrary files.

Detection Methods for CVE-2021-21707

Indicators of Compromise

• HTTP request parameters or file paths containing %00 (URL-encoded NUL characters)
• Unusual XML parsing errors in application logs indicating file path mismatches
• Access logs showing requests with truncated or unexpected file paths
• Error messages referencing files that don't match the requested resource

Detection Strategies

• Monitor web application logs for URL-encoded NUL characters (%00) in file path parameters
• Implement input validation rules to detect and block requests containing NUL bytes
• Use web application firewalls (WAF) with rules to identify path manipulation attempts
• Deploy runtime application security protection to detect anomalous file access patterns

Monitoring Recommendations

• Enable verbose logging for PHP XML parsing functions in development and staging environments
• Configure file integrity monitoring on sensitive configuration and data directories
• Implement security information and event management (SIEM) correlation rules for NUL byte injection patterns
• Review access logs regularly for path traversal indicators

How to Mitigate CVE-2021-21707

Immediate Actions Required

• Upgrade PHP to version 7.3.33, 7.4.26, or 8.0.13 or later immediately
• Audit application code for user-controllable inputs passed to XML parsing functions
• Implement input validation to reject filenames containing NUL characters before processing
• Review and restrict file system permissions for PHP processes

Patch Information

PHP has released patched versions that address this vulnerability. Upgrade to the following versions or later:

• PHP 7.3.33 for the 7.3.x branch
• PHP 7.4.26 for the 7.4.x branch
• PHP 8.0.13 for the 8.0.x branch

For detailed information, refer to the PHP Bug Report #79971. Debian users should consult DSA-5082 and the Debian LTS Announcement. NetApp customers should review the NetApp Security Advisory. Tenable.sc users should apply updates per TNS-2022-09.

Workarounds

• Sanitize all user input by stripping or rejecting NUL characters before passing to XML functions
• Use basename() or similar functions to normalize file paths before processing
• Implement allowlist validation for permitted file paths and extensions
• Consider using realpath() to resolve canonical paths and validate against expected directories

# Example: Input validation in shell scripts processing PHP files
# Strip NUL characters from filename input before processing
sanitized_filename=$(echo "$user_input" | tr -d '\0')

# Validate against allowed directory
if [[ "$sanitized_filename" != /var/www/allowed/* ]]; then
    echo "Invalid file path"
    exit 1
fi