Movable Type CMS XMLRPC API enables remote code execution
Movable Type CMS contains a critical command injection vulnerability in its XMLRPC API allowing remote code execution across all versions since 4.0.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Six Apart's Movable Type content management system is affected by a command injection vulnerability in its XMLRPC API (JVN#57728859). The flaw allows remote unauthenticated attackers to execute arbitrary Perl scripts, which can lead to arbitrary OS command execution on the underlying system. All versions of Movable Type from 4.0 onwards are affected, including end-of-life versions. PowerCMS, which is based on Movable Type, is also potentially vulnerable.
The Japan Information-Technology Promotion Agency (IPA) has classified this as an emergency-severity issue with a CVSS v3 score of 9.8 (Critical) and CVSS v2 score of 7.5 (High). Given the potential for complete system compromise and the broad version range affected, immediate action is required.
Six Apart has released patched versions to address the vulnerability. Organizations unable to immediately update are advised to disable the XMLRPC API functionality as a temporary mitigation measure. The advisory was initially published on August 24, 2022, and updated on September 2, 2022.
Mentioned in this report
Detection guidance
Shell Spawned from Web Server/Perl Process (Possible Movable Type XMLRPC Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell interpreter being spawned as a child of a web server or Perl CGI process, consistent with exploitation of the Movable Type XMLRPC command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned from Web Server or Perl CGI Process
id: 7afb5b00-6137-58ec-b0f8-6e2876e63129
status: experimental
description: Detects a shell (sh, bash, dash) or command interpreter being spawned
as a direct child of a web server process (apache2, httpd, nginx) or a perl interpreter,
which is consistent with exploitation of the Movable Type XMLRPC API command injection
vulnerability (JVN#57728859) that allows execution of arbitrary Perl and subsequently
OS commands.
references:
- https://jvn.jp/en/jp/JVN57728859/
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /apache2
- /httpd
- /nginx
- /perl
- /perl5
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
filter_common_admin:
CommandLine|contains:
- logrotate
- apachectl
- graceful
condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- Legitimate CGI or Perl-based web applications that intentionally invoke shell commands
as part of normal operation
- Server maintenance scripts (log rotation, service reload) triggered by the web server
user
level: high
tags:
- attack.t1059
- attack.t1190
Suspicious Command Injection Characters in Process Spawned from Web Server Context
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects shell metacharacters (pipes, semicolons, backticks) in command lines of processes launched by web server/Perl processes, indicating likely OS command injection via a web application such as Movable Type XMLRPC. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Injection Metacharacters in Process Launched by Web Server
id: ed36b369-7b31-52fa-be29-5b35f2a41af6
status: experimental
description: Detects command lines containing shell metacharacters such as pipes,
semicolons, backticks, or command substitution patterns in processes spawned from
a web server or Perl CGI parent, which is characteristic of remote command injection
exploitation such as the Movable Type XMLRPC API vulnerability (JVN#57728859).
references:
- https://jvn.jp/en/jp/JVN57728859/
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /apache2
- /httpd
- /nginx
- /perl
- /perl5
selection_injection:
CommandLine|contains:
- '; '
- '|'
- '`'
- $(
- '&&'
- 'wget '
- 'curl '
condition: selection_parent and selection_injection
falsepositives:
- Administrative or deployment scripts that legitimately chain shell commands and
run under the web server account
- Health-check or monitoring tools invoked via CGI that use pipes in their command
construction
level: high
tags:
- attack.t1059
- attack.t1190
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20220824-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs