PowerPress Podcasting plugin by Blubrry - XML injection (XXE)

Summary

Name	PowerPress Podcasting plugin by Blubrry 11.10. - XML injection (XXE)
Code name	skims-32
Product	PowerPress Podcasting plugin by Blubrry
Affected versions	Version 11.10.
State	Private
Release date	2025-01-03

Vulnerability

Kind	XML injection (XXE)
Rule	XML injection (XXE)
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AT:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
Exploit available	No
CVE ID(s)	cve-2020-2020

Description

PowerPress Podcasting plugin by Blubrry 11.10. was found to be vulnerable. Access to external entities in XML parsing is enabled in myapp/getid3/getid3.lib.php.

Vulnerability

Skims by Fluid Attacks discovered a XML injection (XXE) in PowerPress Podcasting plugin by Blubrry 11.10.. The following is the output of the tool:

Skims output

 530 | }
 531 | }
 532 | return ($returnkey ? $minkey : $minvalue);
 533 | }
 534 |
 535 | public static function XML2array($XMLstring) {
 536 | if (function_exists('simplexml_load_string') && function_exists('libxml_disable_entity_loader')) {
 537 | // http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
 538 | // https://core.trac.wordpress.org/changeset/29378
 539 | $loader = libxml_disable_entity_loader(true);
>  540 |    $XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', LIBXML_NOENT);
   541 |    $return = self::SimpleXMLelement2array($XMLobject);
   542 |    libxml_disable_entity_loader($loader);
   543 |    return $return;
   544 |   }
   545 |   return false;
   546 |  }
   547 |
   548 |  public static function SimpleXMLelement2array($XMLobject) {
   549 |   if (!is_object($XMLobject) && !is_array($XMLobject)) {
   550 |    return $XMLobject;
       ^ Col 0

Our security policy

We have reserved the ID cve-2020-2020 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Version: PowerPress Podcasting plugin by Blubrry

11.10.

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline