VORANT. Threat Intelligence Sign in Get the full feed

Movable Type XMLRPC flaw under active attack

critical vulnerability technology

A critical OS command injection flaw in Movable Type's XMLRPC API, also affecting PowerCMS, is being actively exploited and the initial patch proved insufficient.

Japan's IPA issued an advisory for a critical OS command injection vulnerability in the XMLRPC API of Six Apart's Movable Type content management system, rated CVSS v3 9.8. The flaw affects all versions from 4.0 onward, including end-of-life releases, and the PowerCMS platform built on Movable Type is also believed to be vulnerable. A remote attacker can exploit the flaw to execute arbitrary OS commands on affected servers.

By November 5, 2021, IPA confirmed that the vulnerability was being actively exploited in the wild, prompting urgent calls for administrators to apply patches or mitigations. On December 16, 2021, the vendor disclosed that the fix released on October 20 was incomplete, requiring users to apply further updates. As a temporary mitigation, Six Apart recommended workarounds via the mt-config.cgi configuration file for environments unable to immediately update.

Given the wide deployment of Movable Type as a CMS platform, the severity of remote code execution, and confirmed in-the-wild exploitation combined with an initially inadequate patch, this represents a significant ongoing risk requiring prompt remediation.

Mentioned in this report

Vulnerabilities CVE-2021-38350

Detection guidance

Movable Type XMLRPC CGI Spawning Shell Process (Linux)

ATT&CK T1190

Detects a web server or Perl CGI process (as used by Movable Type mt-xmlrpc.cgi) spawning a shell interpreter, indicative of OS command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Movable Type XMLRPC CGI Spawning Shell Process (Linux)
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - /httpd
    - /apache2
    - /nginx
    - /perl
    - mt-xmlrpc.cgi
    - mt.cgi
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  filter:
    CommandLine|contains:
    - logrotate
    - cron
  condition: selection and not filter
  falsepositives:
  - Legitimate CGI scripts that intentionally shell out for administrative tasks (rare
    in production Movable Type deployments)
  - Custom Movable Type plugins invoking shell utilities as part of normal operation
  level: high
  tags:
  - attack.t1190
id: 086a9076-ee82-5dd0-9843-c9fb715620ac
status: experimental
author: Vorant

Web Server Process Spawning Command Interpreter (Windows CMS Exploitation)

ATT&CK T1190

Detects a web server or Perl-based CGI process (consistent with Movable Type running under IIS/Apache on Windows) launching cmd.exe or PowerShell, suggesting successful command injection via the XMLRPC API. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Interpreter (Windows CMS Exploitation)
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \perl.exe
    - \apache.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter:
    CommandLine|contains:
    - IisResetHelper
    - appcmd.exe
  condition: selection and not filter
  falsepositives:
  - Legitimate administrative scripts or health-check tooling invoked by the web server
    process
  - Custom ISAPI/CGI extensions that intentionally call cmd.exe for scheduled maintenance
  level: high
  tags:
  - attack.t1190
id: 0342ea7f-8eb3-5056-a3a1-7809f8ff5d9c
status: experimental
author: Vorant

Outbound Connection from CMS Web Process to Unusual Port

ATT&CK T1190

Detects a web server or CGI process associated with a CMS (e.g., Movable Type) initiating outbound network connections to non-standard ports, potentially indicating a reverse shell established after successful XMLRPC command injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Outbound Connection from CMS Web Process to Unusual Port
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
    - /httpd
    - /apache2
    - /perl
    - mt-xmlrpc.cgi
    Initiated: true
  filter:
    DestinationPort:
    - 80
    - 443
    - 53
  condition: selection and not filter
  falsepositives:
  - Web server processes performing legitimate outbound API calls or webhook notifications
    on non-standard ports
  - Health-check or monitoring agents embedded in the CMS process tree
  level: medium
  tags:
  - attack.t1190
id: 692e847c-9e2c-5210-a67e-6048c1bc0e91
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20211020-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free