CVE-2021-29447: WordPress XXE Vulnerability in Media Library

CVE-2021-29447 Overview

CVE-2021-29447 is an XML External Entity (XXE) vulnerability affecting WordPress, one of the most widely deployed open-source content management systems. A user with the ability to upload files (such as an Author role) can exploit an XML parsing issue in the Media Library to conduct XXE attacks. This vulnerability specifically requires the WordPress installation to be running on PHP 8. Successful exploitation enables attackers to access internal files on the server, potentially exposing sensitive configuration data, credentials, and other critical information.

Critical Impact

Authenticated users with file upload privileges can exploit XML parsing flaws to read arbitrary server files, potentially exposing database credentials, configuration files, and other sensitive data from the WordPress installation.

Affected Products

• WordPress versions prior to 5.7.1 (running on PHP 8)
• Debian Linux 9.0
• Debian Linux 10.0

Discovery Timeline

• April 15, 2021 - CVE-2021-29447 published to NVD
• April 2021 - WordPress releases security patch in version 5.7.1
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-29447

Vulnerability Analysis

This XML External Entity (XXE) vulnerability exists in WordPress's Media Library component, specifically in how it processes metadata from uploaded media files. When a user uploads a specially crafted media file (such as an MP3 or WAV file containing malicious XML in its metadata), the WordPress application parses this XML content using PHP's built-in XML processing functions.

On PHP 8 installations, the XML parser processes external entity references without proper restrictions, allowing attackers to reference local files or internal network resources. The vulnerability is particularly concerning because it can be exploited by authenticated users with relatively low privileges—any user role that has file upload capabilities (Author and above) can potentially trigger this flaw.

Root Cause

The root cause of CVE-2021-29447 lies in WordPress's handling of XML metadata embedded within media files. When processing uploaded files, WordPress extracts and parses metadata using PHP's XML functions. In PHP 8 environments, the libxml_disable_entity_loader() function—which was previously used to prevent XXE attacks—was deprecated and no longer functions as expected. This created a security gap where external entity declarations in XML content are processed without adequate sanitization, enabling attackers to include references to arbitrary files or URLs that the server will then attempt to resolve and include in the parsed output.

Attack Vector

The attack is conducted over the network and requires low-privilege authenticated access. An attacker first creates a malicious media file (typically an MP3 or WAV file) with embedded XML metadata containing external entity declarations pointing to sensitive files such as /etc/passwd or WordPress's wp-config.php. The attacker then uploads this file through WordPress's Media Library interface. When WordPress processes the file to extract its metadata, the XML parser resolves the external entities, causing the server to read the targeted files. The file contents can then be exfiltrated through various techniques, including DNS-based data exfiltration or out-of-band HTTP requests to attacker-controlled servers.

For detailed technical exploitation information, see the SonarSource Blog Analysis and the GitHub Security Advisory. A proof-of-concept demonstrating this vulnerability is available at the CVE-2021-29447 PoC Repository.

Detection Methods for CVE-2021-29447

Indicators of Compromise

• Unusual media file uploads with suspicious or malformed metadata structures
• Web server logs showing requests for sensitive files like wp-config.php or /etc/passwd from the media upload handler
• Outbound DNS queries or HTTP requests to suspicious external domains from the WordPress server during file upload processing
• Error logs containing XML parsing errors or external entity resolution failures

Detection Strategies

• Monitor file upload activity for anomalous media files, particularly those with embedded XML payloads in metadata fields
• Implement web application firewall (WAF) rules to detect XXE attack patterns in uploaded file content
• Review Apache or Nginx access logs for unusual patterns in media upload endpoints (/wp-admin/async-upload.php)
• Deploy endpoint detection solutions to identify unauthorized file access attempts on sensitive configuration files

Monitoring Recommendations

• Enable verbose logging for WordPress's media upload functionality and XML processing operations
• Configure alerts for outbound network connections initiated during media file processing
• Monitor for unexpected DNS resolution requests that could indicate data exfiltration attempts
• Audit user accounts with file upload privileges and review their upload activity regularly

How to Mitigate CVE-2021-29447

Immediate Actions Required

• Update WordPress immediately to version 5.7.1 or later, which contains the security patch for this vulnerability
• Verify that all WordPress installations using PHP 8 are running patched versions
• Review and restrict user roles that have file upload capabilities to only those users who require them
• Audit recent media uploads for suspicious file metadata or unusual file structures

Patch Information

WordPress has released version 5.7.1 which addresses CVE-2021-29447. Additionally, minor security releases have been published for older WordPress branches to provide backported fixes. It is strongly recommended to enable auto-updates for WordPress to ensure timely application of security patches. Debian users should apply the fixes documented in DSA-4896 and the Debian LTS Announcement. Official security updates are available through the WordPress Security Updates page.

Workarounds

• If immediate patching is not possible, consider temporarily restricting file upload capabilities by modifying user roles
• Implement additional server-level protections to disable external entity loading in PHP's XML parser configuration
• Deploy a web application firewall with rules specifically designed to detect and block XXE attack payloads
• Consider downgrading to PHP 7.x temporarily if upgrading WordPress is not immediately feasible (note: this is not recommended as a long-term solution)

# PHP configuration to help mitigate XXE attacks
# Add to php.ini or relevant configuration file

# Disable loading of external entities (for PHP versions where applicable)
libxml.disable_external_entities = 1

# Restrict file upload handling
file_uploads = On
upload_max_filesize = 10M
max_file_uploads = 5