Movable Type XMLRPC API command injection exploited

15 December 2021 critical vulnerability

Movable Type CMS contains a critical OS command injection vulnerability in its XMLRPC API that is being actively exploited, requiring immediate patching.

Six Apart's Movable Type content management system contains a critical OS command injection vulnerability (JVN#41119755) in its XMLRPC API. This vulnerability affects all versions from Movable Type 4.0 onwards, including end-of-life versions. Remote attackers can exploit this flaw to execute arbitrary OS commands on affected systems. As of November 5, 2021, active exploitation of this vulnerability has been confirmed in the wild. Six Apart initially released patches on October 20, 2021, but on December 16, 2021, announced that the original fixes were insufficient and released updated versions. PowerCMS, a CMS based on Movable Type, is also potentially affected by this vulnerability. The vendor has assigned this a CVSS v3 score of 9.8 (Critical) and CVSS v2 score of 7.5, reflecting the severe impact potential. For organizations unable to immediately patch, Six Apart provides a mitigation option through configuration file modifications in mt-config.cgi, though full patching remains the recommended solution.

Detection guidance

Web Server Process Spawning Shell Interpreter (Movable Type Command Injection)

ATT&CK T1190

Detects a web server or Perl CGI process (as used by Movable Type mt.cgi/mt-xmlrpc.cgi) spawning a shell interpreter, consistent with OS command injection via the XMLRPC API. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Spawning Shell After Possible CGI Command Injection
id: c32a122d-5a33-59ff-9ecb-3716164431e7
status: experimental
description: 'Detects a shell (/bin/sh, /bin/bash, dash) spawned directly by a web
  server or Perl CGI

  process (httpd, apache2, nginx, perl), consistent with exploitation of the Movable
  Type

  XMLRPC API OS command injection vulnerability (JVN#41119755).

  '
references:
- https://jvn.jp/en/jp/JVN41119755/
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /perl
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
  filter_cron_or_logrotate:
    CommandLine|contains:
    - logrotate
    - cron
  condition: selection and not filter_cron_or_logrotate
falsepositives:
- Legitimate CGI scripts that shell out to system utilities for scheduled maintenance
- Custom web application health-check or deployment scripts invoking shell commands
level: high
tags:
- attack.t1190
- attack.t1059
author: Vorant

IIS/Web Server Process Spawning Command Interpreter (Windows)

ATT&CK T1190

Detects cmd.exe or powershell.exe spawned by a Windows web server process (w3wp.exe, httpd.exe, nginx.exe), consistent with exploitation of Movable Type XMLRPC command injection on IIS/Windows hosted PowerCMS/MT instances. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Command Interpreter Spawned by Web Server Process
id: b0bebf79-c6de-57aa-bcc0-907ab9f7ba9b
status: experimental
description: 'Detects cmd.exe or powershell.exe launched as a child process of a web
  server process

  (w3wp.exe, httpd.exe, nginx.exe), which can indicate remote command execution via
  a web

  application vulnerability such as the Movable Type XMLRPC API OS command injection

  (JVN#41119755).

  '
references:
- https://jvn.jp/en/jp/JVN41119755/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
  filter_known_admin:
    CommandLine|contains:
    - IISReset
  condition: selection and not filter_known_admin
falsepositives:
- Administrative scripts or scheduled tasks that invoke cmd.exe/powershell.exe from
  IIS worker process for legitimate management tasks
- Third-party web application monitoring agents that shell out from the web server
  process
level: high
tags:
- attack.t1190
- attack.t1059.001
- attack.t1059.003
author: Vorant

Reconnaissance or Download Commands Executed by Web Server Process

ATT&CK T1059

Detects common post-exploitation recon or payload-download commands (id, whoami, uname, wget, curl) executed with a web server or CGI process as parent, indicating successful OS command injection via a public-facing CMS such as Movable Type. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon or Download Commands Launched by Web Server Parent
id: 668ededf-d053-5d6b-9835-eeb3f5a0f6a8
status: experimental
description: 'Detects common reconnaissance or payload-retrieval commands (id, whoami,
  uname, wget, curl)

  executed with a web server/CGI process (httpd, apache2, nginx, perl) as the parent,

  consistent with post-exploitation activity following OS command injection through
  the

  Movable Type XMLRPC API vulnerability.

  '
references:
- https://jvn.jp/en/jp/JVN41119755/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /perl
  selection_cmd:
    Image|endswith:
    - /id
    - /whoami
    - /uname
    - /wget
    - /curl
  condition: selection_parent and selection_cmd
falsepositives:
- Health-check or monitoring scripts invoked from CGI handlers that legitimately call
  uname/whoami
- Package or deployment automation that uses curl/wget from a web-server-launched
  maintenance script
level: medium
tags:
- attack.t1059
- attack.t1190
- attack.t1059.004
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20211020-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free