Movable Type XMLRPC flaw enables command injection

A critical command-injection vulnerability in Movable Type's XMLRPC API lets remote attackers execute arbitrary Perl and OS commands.

IPA and JVN have published an advisory for a critical vulnerability in Six Apart's Movable Type CMS, affecting the XMLRPC API. The flaw allows a remote, unauthenticated attacker to inject and execute arbitrary Perl scripts, which can in turn be used to run arbitrary OS commands on the underlying server. All versions of Movable Type from 4.0 onward are affected, including versions that have already reached end-of-support, significantly widening the exposure since many deployments may no longer receive vendor patches.

The vulnerability also impacts PowerCMS, a derivative CMS built on the Movable Type codebase. Given the CVSS v3 score of 9.8 (critical), the vendor and IPA urge immediate patching to the fixed versions. As a mitigation for organizations unable to patch immediately, the vendor recommends disabling the XMLRPC API functionality to reduce exposure until an update can be applied.

title: Web Server Process Spawning Command Shell (Possible Movable Type XMLRPC Exploitation)
id: 0dee8929-76c9-567d-afda-f487ee288b29
status: experimental
description: 'Detects a web server or CGI/Perl interpreter process spawning a command
  shell or scripting interpreter.

  This behaviour is consistent with exploitation of the Movable Type XMLRPC API command
  injection vulnerability

  (CVE-2021 class, IPA/JVN advisory), where an unauthenticated attacker injects Perl
  code executed by the

  web server, which is then used to invoke arbitrary OS commands.

  '
references:
- https://www.ipa.go.jp/security/
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \httpd.exe
    - \apache.exe
    - \perl.exe
    - \w3wp.exe
    - \nginx.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \sh.exe
    - \bash.exe
  filter_common_admin:
    CommandLine|contains:
    - C:\Program Files\Common Files\Apache Software Foundation
  condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- Legitimate CGI scripts that intentionally invoke shell utilities for administrative
  tasks
- Custom web application modules that call system utilities as part of normal operation
level: high
tags:
- attack.t1190
- attack.t1059

title: Web Server Process Executing OS Reconnaissance or Download Commands (Movable
  Type XMLRPC Exploitation)
id: 8c752334-0896-5f9f-ae21-b86a91a1b737
status: experimental
description: 'Detects command-line arguments typical of reconnaissance or payload
  download activity (whoami, id, uname,

  wget, curl) executed by a process whose parent is a web server or Perl interpreter.
  This pattern matches

  post-exploitation behaviour following successful command injection via the Movable
  Type XMLRPC API flaw,

  where injected Perl code is used to run arbitrary OS commands on the underlying
  server.

  '
references:
- https://www.ipa.go.jp/security/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /perl
    - /nginx
  selection_cmd:
    CommandLine|contains:
    - whoami
    - ' id '
    - uname -a
    - 'wget '
    - 'curl '
    - /bin/sh -c
    - /bin/bash -c
  condition: selection_parent and selection_cmd
falsepositives:
- Health-check or monitoring scripts invoked by the web server that legitimately call
  system info commands
- Deployment automation triggered through CGI wrappers that call wget/curl for legitimate
  asset retrieval
level: high
tags:
- attack.t1059
- attack.t1190

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20220824-jvn.html