# Movable Type XMLRPC flaw under active attack

Published: 2021-12-15 · Severity: critical · Sectors: technology
Canonical: https://vorant.io/reports/b5c76916-a4eb-5361-ac48-cfe08b96a813/movable-type-xmlrpc-flaw-under-active-attack

> A critical OS command injection flaw in Movable Type's XMLRPC API, also affecting PowerCMS, is being actively exploited and the initial patch proved insufficient.

Japan's IPA issued an advisory for a critical OS command injection vulnerability in the XMLRPC API of Six Apart's Movable Type content management system, rated CVSS v3 9.8. The flaw affects all versions from 4.0 onward, including end-of-life releases, and the PowerCMS platform built on Movable Type is also believed to be vulnerable. A remote attacker can exploit the flaw to execute arbitrary OS commands on affected servers.

By November 5, 2021, IPA confirmed that the vulnerability was being actively exploited in the wild, prompting urgent calls for administrators to apply patches or mitigations. On December 16, 2021, the vendor disclosed that the fix released on October 20 was incomplete, requiring users to apply further updates. As a temporary mitigation, Six Apart recommended workarounds via the mt-config.cgi configuration file for environments unable to immediately update.

Given the wide deployment of Movable Type as a CMS platform, the severity of remote code execution, and confirmed in-the-wild exploitation combined with an initially inadequate patch, this represents a significant ongoing risk requiring prompt remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2021-38350

## Detection guidance (public sample)

### Movable Type XMLRPC CGI Spawning Shell Process (Linux)

ATT&CK: T1190

Detects a web server or Perl CGI process (as used by Movable Type mt-xmlrpc.cgi) spawning a shell interpreter, indicative of OS command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Movable Type XMLRPC CGI Spawning Shell Process (Linux)
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - /httpd
    - /apache2
    - /nginx
    - /perl
    - mt-xmlrpc.cgi
    - mt.cgi
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  filter:
    CommandLine|contains:
    - logrotate
    - cron
  condition: selection and not filter
  falsepositives:
  - Legitimate CGI scripts that intentionally shell out for administrative tasks (rare
    in production Movable Type deployments)
  - Custom Movable Type plugins invoking shell utilities as part of normal operation
  level: high
  tags:
  - attack.t1190
id: 086a9076-ee82-5dd0-9843-c9fb715620ac
status: experimental
author: Vorant
```

### Web Server Process Spawning Command Interpreter (Windows CMS Exploitation)

ATT&CK: T1190

Detects a web server or Perl-based CGI process (consistent with Movable Type running under IIS/Apache on Windows) launching cmd.exe or PowerShell, suggesting successful command injection via the XMLRPC API. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Command Interpreter (Windows CMS Exploitation)
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \perl.exe
    - \apache.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter:
    CommandLine|contains:
    - IisResetHelper
    - appcmd.exe
  condition: selection and not filter
  falsepositives:
  - Legitimate administrative scripts or health-check tooling invoked by the web server
    process
  - Custom ISAPI/CGI extensions that intentionally call cmd.exe for scheduled maintenance
  level: high
  tags:
  - attack.t1190
id: 0342ea7f-8eb3-5056-a3a1-7809f8ff5d9c
status: experimental
author: Vorant
```

### Outbound Connection from CMS Web Process to Unusual Port

ATT&CK: T1190

Detects a web server or CGI process associated with a CMS (e.g., Movable Type) initiating outbound network connections to non-standard ports, potentially indicating a reverse shell established after successful XMLRPC command injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Connection from CMS Web Process to Unusual Port
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
    - /httpd
    - /apache2
    - /perl
    - mt-xmlrpc.cgi
    Initiated: true
  filter:
    DestinationPort:
    - 80
    - 443
    - 53
  condition: selection and not filter
  falsepositives:
  - Web server processes performing legitimate outbound API calls or webhook notifications
    on non-standard ports
  - Health-check or monitoring agents embedded in the CMS process tree
  level: medium
  tags:
  - attack.t1190
id: 692e847c-9e2c-5210-a67e-6048c1bc0e91
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20211020-jvn.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b5c76916-a4eb-5361-ac48-cfe08b96a813/movable-type-xmlrpc-flaw-under-active-attack.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup