Movable Type XMLRPC flaw enables RCE

1 September 2022 routine vulnerability technology

A critical command injection vulnerability in Movable Type's XMLRPC API lets remote attackers execute arbitrary Perl and OS commands.

Six Apart's Movable Type content management system contains a command injection vulnerability in its XMLRPC API that allows a remote, unauthenticated attacker to execute arbitrary Perl scripts, and by extension arbitrary OS commands, on the underlying server. IPA rates the flaw as critical (CVSS v3: 9.8) and notes that all versions of Movable Type from 4.0 onward, including versions that have reached end-of-support, are affected. PowerCMS, a CMS built on top of Movable Type, may also be impacted by the same vulnerability.

Given the severity and ease of remote exploitation, IPA urges administrators to apply vendor-supplied updates as soon as possible. Where patching is not immediately feasible, disabling the XMLRPC API functionality in Movable Type is recommended as a mitigating measure. No indicators of active exploitation, threat actors, or specific campaigns are described in this advisory; it is a vendor patch notice distributed by Japan's IPA security center.

Mentioned in this report

Vulnerabilities CVE-2022-36328

Detection guidance

Movable Type XMLRPC API Command Injection Attempt

ATT&CK T1190

HTTP POST to Movable Type XMLRPC endpoint with suspicious Perl/shell metacharacters or command injection patterns in request body. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Movable Type XMLRPC API Command Injection Attempt
description: Detects HTTP POST requests to Movable Type's XMLRPC API endpoint containing
  command injection metacharacters (backticks, pipes, semicolons, $()) typical of
  Perl/shell command execution attempts.
tags:
- attack.t1190
logsource:
  category: proxy
  product: windows
detection:
  selection:
    http_method: POST
    uri|contains:
    - /mt-xmlrpc.cgi
    - /xmlrpc.cgi
    http_body|contains:
    - '`'
    - '|'
    - ;
    - $(
    - exec
    - system
    - eval
  filter_legitimate_xml:
    http_body|contains:
    - <?xml
    - <rpc>
  condition: selection and not filter_legitimate_xml
falsepositives:
- Legitimate Movable Type XMLRPC clients sending complex payloads with encoded special
  characters
- Security scanning tools probing the endpoint
level: high
id: 674a94d8-5a27-5d34-9708-fb4b324d6177
status: experimental
author: Vorant

Movable Type Web Server Executing Perl Interpreter After XMLRPC Request

ATT&CK T1059.001

Web server process (apache/nginx) spawning perl.exe/perl with suspicious arguments immediately following an HTTP POST to XMLRPC endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Movable Type Web Server Executing Perl Interpreter After XMLRPC Request
description: Detects web server processes (Apache, Nginx) spawning perl.exe or perl
  interpreter with command-line arguments, which may indicate XMLRPC command injection
  leading to Perl script execution.
tags:
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \apache.exe
    - \apache2.exe
    - \nginx.exe
    - \httpd.exe
    Image|endswith:
    - \perl.exe
    - \perl5.exe
    CommandLine|contains:
    - exec
    - system
    - eval
    - open |
  filter_legitimate_perl:
    CommandLine|contains:
    - .pl
    - lib/perl
  condition: selection and not filter_legitimate_perl
falsepositives:
- Movable Type legitimate Perl modules executing during normal CMS operations
- Web server plugins that invoke Perl interpreters for template processing
level: high
id: 0fcd2330-8ab8-509e-9591-d23c61e38650
status: experimental
author: Vorant

Movable Type Web Server Spawning Shell or Command Interpreter After XMLRPC

ATT&CK T1059.001

Web server process (apache/nginx) spawning cmd.exe, powershell.exe, or /bin/bash following HTTP activity on XMLRPC endpoint, indicating command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Movable Type Web Server Spawning Shell Interpreter After XMLRPC
description: Detects web server processes spawning command shells (cmd.exe, powershell.exe,
  /bin/sh, /bin/bash) which may indicate OS command execution following XMLRPC command
  injection exploitation.
tags:
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \apache.exe
    - \apache2.exe
    - \nginx.exe
    - \httpd.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter_maintenance:
    CommandLine|contains:
    - Movable Type update
    - backup
  condition: selection and not filter_maintenance
falsepositives:
- Web server plugins or modules that legitimately spawn shells for system administration
  tasks
- Automated Movable Type backup or maintenance scripts running under web server context
level: high
id: dd0e5384-0671-530f-a957-8c340fde4fe9
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20220824-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free