Recently WordPress patched XXE vulnerability http://wordpress.org/news/2014/08/wordpress-3-9-2/ which were found during @ONsec_lab security audit of another one web-application.
Now time to describe this vulnerability in details!
The reason is GetID3 library which included into WordPress by default:
./wp-includes/ID3/getid3.lib.php:
521 public static function XML2array($XMLstring) {
522 if (function_exists('simplexml_load_string')) {
523 if (function_exists('get_object_vars')) {
524 $XMLobject = simplexml_load_string($XMLstring);
Requires PHP 5.5.0- (simple_xml was patched to disable external entities since ~5.5.0)
To use this vulnerability attacker must have privileges to upload Media (editor privileges for example).
PoC is available at our GitHub repo: https://github.com/ONsec-Lab/scripts/blob/master/getid3-xxe.wav
Timeline:
5/12/14 vendor notified
5/15/14 vulnerability confirmed
8/06/14 fixed at version 3.9.2
Now time to describe this vulnerability in details!
The reason is GetID3 library which included into WordPress by default:
./wp-includes/ID3/getid3.lib.php:
521 public static function XML2array($XMLstring) {
522 if (function_exists('simplexml_load_string')) {
523 if (function_exists('get_object_vars')) {
524 $XMLobject = simplexml_load_string($XMLstring);
Requires PHP 5.5.0- (simple_xml was patched to disable external entities since ~5.5.0)
To use this vulnerability attacker must have privileges to upload Media (editor privileges for example).
PoC is available at our GitHub repo: https://github.com/ONsec-Lab/scripts/blob/master/getid3-xxe.wav
Timeline:
5/12/14 vendor notified
5/15/14 vulnerability confirmed
8/06/14 fixed at version 3.9.2