Movable Type XMLRPC flaw enables RCE
A critical command injection vulnerability in Movable Type's XMLRPC API lets remote attackers execute arbitrary Perl and OS commands.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Six Apart's Movable Type content management system contains a command injection vulnerability in its XMLRPC API that allows a remote, unauthenticated attacker to execute arbitrary Perl scripts, and by extension arbitrary OS commands, on the underlying server. IPA rates the flaw as critical (CVSS v3: 9.8) and notes that all versions of Movable Type from 4.0 onward, including versions that have reached end-of-support, are affected. PowerCMS, a CMS built on top of Movable Type, may also be impacted by the same vulnerability.
Given the severity and ease of remote exploitation, IPA urges administrators to apply vendor-supplied updates as soon as possible. Where patching is not immediately feasible, disabling the XMLRPC API functionality in Movable Type is recommended as a mitigating measure. No indicators of active exploitation, threat actors, or specific campaigns are described in this advisory; it is a vendor patch notice distributed by Japan's IPA security center.
Mentioned in this report
Detection guidance
Movable Type Web Server Executing Perl Interpreter After XMLRPC Request
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Web server process (apache/nginx) spawning perl.exe/perl with suspicious arguments immediately following an HTTP POST to XMLRPC endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Movable Type Web Server Executing Perl Interpreter After XMLRPC Request
description: Detects web server processes (Apache, Nginx) spawning perl.exe or perl
interpreter with command-line arguments, which may indicate XMLRPC command injection
leading to Perl script execution.
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \apache.exe
- \apache2.exe
- \nginx.exe
- \httpd.exe
Image|endswith:
- \perl.exe
- \perl5.exe
CommandLine|contains:
- exec
- system
- eval
- open |
filter_legitimate_perl:
CommandLine|contains:
- .pl
- lib/perl
condition: selection and not filter_legitimate_perl
falsepositives:
- Movable Type legitimate Perl modules executing during normal CMS operations
- Web server plugins that invoke Perl interpreters for template processing
level: high
id: 0fcd2330-8ab8-509e-9591-d23c61e38650
status: experimental
author: Vorant
Movable Type Web Server Spawning Shell or Command Interpreter After XMLRPC
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Web server process (apache/nginx) spawning cmd.exe, powershell.exe, or /bin/bash following HTTP activity on XMLRPC endpoint, indicating command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Movable Type Web Server Spawning Shell Interpreter After XMLRPC
description: Detects web server processes spawning command shells (cmd.exe, powershell.exe,
/bin/sh, /bin/bash) which may indicate OS command execution following XMLRPC command
injection exploitation.
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \apache.exe
- \apache2.exe
- \nginx.exe
- \httpd.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
filter_maintenance:
CommandLine|contains:
- Movable Type update
- backup
condition: selection and not filter_maintenance
falsepositives:
- Web server plugins or modules that legitimately spawn shells for system administration
tasks
- Automated Movable Type backup or maintenance scripts running under web server context
level: high
id: dd0e5384-0671-530f-a957-8c340fde4fe9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20220824-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs