# Movable Type CMS contains a critical command injection vulnerability in its XMLRPC API…

Published: 2022-09-01 · Severity: critical
Canonical: https://vorant.io/reports/3a1ba0ac-96ae-4cdb-8c12-cc13b803befd/movable-type-cms-contains-a-critical-command-injection-vulnerability-in-its

> Movable Type CMS contains a critical command injection vulnerability in its XMLRPC API allowing remote code execution across all versions since 4.0.

Six Apart's Movable Type content management system is affected by a command injection vulnerability in its XMLRPC API (JVN#57728859). The flaw allows remote unauthenticated attackers to execute arbitrary Perl scripts, which can lead to arbitrary OS command execution on the underlying system. All versions of Movable Type from 4.0 onwards are affected, including end-of-life versions. PowerCMS, which is based on Movable Type, is also potentially vulnerable.

The Japan Information-Technology Promotion Agency (IPA) has classified this as an emergency-severity issue with a CVSS v3 score of 9.8 (Critical) and CVSS v2 score of 7.5 (High). Given the potential for complete system compromise and the broad version range affected, immediate action is required.

Six Apart has released patched versions to address the vulnerability. Organizations unable to immediately update are advised to disable the XMLRPC API functionality as a temporary mitigation measure. The advisory was initially published on August 24, 2022, and updated on September 2, 2022.

## Mentioned in this report

- Vulnerabilities: CVE-2022-37414

## Detection guidance (public sample)

### Shell Spawned from Web Server/Perl Process (Possible Movable Type XMLRPC Command Injection)

ATT&CK: T1059

Detects a shell interpreter being spawned as a child of a web server or Perl CGI process, consistent with exploitation of the Movable Type XMLRPC command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shell Spawned from Web Server or Perl CGI Process
id: 7afb5b00-6137-58ec-b0f8-6e2876e63129
status: experimental
description: Detects a shell (sh, bash, dash) or command interpreter being spawned
  as a direct child of a web server process (apache2, httpd, nginx) or a perl interpreter,
  which is consistent with exploitation of the Movable Type XMLRPC API command injection
  vulnerability (JVN#57728859) that allows execution of arbitrary Perl and subsequently
  OS commands.
references:
- https://jvn.jp/en/jp/JVN57728859/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /perl
    - /perl5
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
  filter_common_admin:
    CommandLine|contains:
    - logrotate
    - apachectl
    - graceful
  condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- Legitimate CGI or Perl-based web applications that intentionally invoke shell commands
  as part of normal operation
- Server maintenance scripts (log rotation, service reload) triggered by the web server
  user
level: high
tags:
- attack.t1059
- attack.t1190
```

### Suspicious Command Injection Characters in Process Spawned from Web Server Context

ATT&CK: T1059

Detects shell metacharacters (pipes, semicolons, backticks) in command lines of processes launched by web server/Perl processes, indicating likely OS command injection via a web application such as Movable Type XMLRPC. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Injection Metacharacters in Process Launched by Web Server
id: ed36b369-7b31-52fa-be29-5b35f2a41af6
status: experimental
description: Detects command lines containing shell metacharacters such as pipes,
  semicolons, backticks, or command substitution patterns in processes spawned from
  a web server or Perl CGI parent, which is characteristic of remote command injection
  exploitation such as the Movable Type XMLRPC API vulnerability (JVN#57728859).
references:
- https://jvn.jp/en/jp/JVN57728859/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /perl
    - /perl5
  selection_injection:
    CommandLine|contains:
    - '; '
    - '|'
    - '`'
    - $(
    - '&&'
    - 'wget '
    - 'curl '
  condition: selection_parent and selection_injection
falsepositives:
- Administrative or deployment scripts that legitimately chain shell commands and
  run under the web server account
- Health-check or monitoring tools invoked via CGI that use pipes in their command
  construction
level: high
tags:
- attack.t1059
- attack.t1190
```

### HTTP Request to Movable Type XMLRPC Endpoint with Suspicious Payload

ATT&CK: T1190

Detects inbound HTTP requests to the Movable Type mt-xmlrpc.cgi endpoint containing shell metacharacters or command execution keywords in the request body/URI, indicative of exploitation attempts against the XMLRPC command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HTTP Request to mt-xmlrpc.cgi with Command Injection Indicators
id: 6e20cda3-4d07-5ff9-bd53-0d260cf9fc86
status: experimental
description: Detects HTTP requests targeting the Movable Type XMLRPC API endpoint
  (mt-xmlrpc.cgi) that contain shell metacharacters or command execution keywords
  in the URI or request body, consistent with exploitation of the JVN#57728859 command
  injection vulnerability.
references:
- https://jvn.jp/en/jp/JVN57728859/
author: Vorant
logsource:
  category: proxy
  product: windows
detection:
  selection_endpoint:
    cs-uri-stem|contains: mt-xmlrpc.cgi
  selection_injection:
    cs-uri-query|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '&&'
    - wget
    - curl
    - /bin/sh
    - /bin/bash
  condition: selection_endpoint and selection_injection
falsepositives:
- Legitimate automated XMLRPC clients or integrations passing unusual but benign query
  parameters
- Security scanners or vulnerability assessment tools probing the endpoint intentionally
level: medium
tags:
- attack.t1190
- attack.t1059
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20220824-jvn.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3a1ba0ac-96ae-4cdb-8c12-cc13b803befd/movable-type-cms-contains-a-critical-command-injection-vulnerability-in-its.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup