CVE-2021-20837

What it actually does

This is an unauthenticated, network-exploitable OS command injection vulnerability in Movable Type and Movable Type Advanced/Premium. A remote attacker can cause the application to pass attacker-controlled input to the underlying operating system, resulting in arbitrary command execution with the privileges of the web server or Movable Type application account. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can lead to full application compromise, data theft, webshell deployment, malware installation, lateral movement, and service disruption. The exploit maturity is weaponized and EPSS is very high, indicating broad attacker interest and a high likelihood of exploitation attempts against internet-facing systems.

Why it matters to the business

Organizations running affected Movable Type instances face a high-risk remote takeover scenario, especially where publishing/admin CGI endpoints are reachable from the internet. Compromise can allow attackers to alter published content, steal credentials or content data, use the server as an entry point into adjacent infrastructure, install persistent malware, or disrupt publishing operations. Unsupported end-of-life Movable Type 4.x and later versions are also affected, increasing risk for legacy deployments that may not have a straightforward patch path. The vulnerability has been public for years and is weaponized, so exposed unpatched systems should be treated as likely targeted.

How an attack unfolds

An attacker first identifies a Movable Type installation, commonly by discovering exposed Movable Type CGI endpoints, login pages, static assets, version banners, or recognizable response patterns. The attacker then sends a crafted unauthenticated HTTP request to a vulnerable application endpoint containing shell metacharacters or payload content that reaches an unsafe OS command execution path. If successful, the application invokes an operating system command using attacker-controlled input, causing commands to run as the web server or Movable Type process user. The attacker typically verifies execution with low-noise commands such as `id`, `whoami`, or `uname`, then downloads additional tooling using `curl` or `wget`, writes files under web-accessible or temporary directories, changes permissions, and executes a payload. Follow-on activity may include deploying a webshell, adding scheduled tasks or cron jobs, harvesting configuration files and credentials, modifying site content, pivoting to databases or internal services, and removing or tampering with logs.

How to fix it

Upgrade Movable Type, Movable Type Advanced, Movable Type Premium, and related components to a vendor-supported fixed release. Based on the affected-version ranges, systems running Movable Type 7 r.5002 or earlier, Movable Type 6.8.2 or earlier, Movable Type Advanced 7 r.5002 or earlier, Movable Type Advanced 6.8.2 or earlier, Movable Type Premium 1.46 or earlier, Movable Type Premium Advanced 1.46 or earlier, and unsupported Movable Type 4.x or later should be considered vulnerable until upgraded or decommissioned. If immediate upgrade is not possible, restrict access to Movable Type administrative and CGI endpoints to trusted management networks or VPN, disable unused XML-RPC or CGI interfaces where operationally feasible, place the application behind a WAF with command-injection rules, remove unsupported legacy versions, ensure the web server account has least privilege, block outbound network access from the application server except where required, and monitor for child shell processes spawned by web server or CGI processes. Because this is a command execution issue with weaponized exploitation, exposed vulnerable instances should be isolated and investigated before being returned to service.

How to confirm the fix worked

Confirm the installed Movable Type product and version against the vulnerable ranges and verify it has been upgraded to a vendor-supported fixed release. Review public exposure for Movable Type CGI endpoints and ensure administrative interfaces are not reachable from untrusted networks. Use safe, non-destructive vulnerability scanning or authenticated inventory rather than attempting live command-execution payloads in production. Validate web server and application configuration changes by confirming that unauthenticated external requests to administrative, XML-RPC, and CGI endpoints are blocked or require appropriate authentication and network access. After remediation, review logs for prior exploitation attempts, rotate credentials stored on or used by the Movable Type server, and verify no unexpected files, cron entries, webshells, or suspicious processes remain.

Typical attack path

1. Scan the internet or target ranges for exposed Movable Type installations and CGI endpoints such as Movable Type admin or XML-RPC interfaces.
2. Fingerprint the application version or infer vulnerability from exposed files, response headers, page content, or known endpoint behavior.
3. Send a crafted unauthenticated HTTP request containing command-injection syntax to the vulnerable Movable Type endpoint.
4. Confirm remote command execution using simple commands such as `id`, `whoami`, `uname -a`, or DNS/HTTP callbacks.
5. Use command execution to download and run a second-stage payload with tools such as `curl`, `wget`, `perl`, `python`, or shell redirection.
6. Establish persistence through webshells, modified application files, cron entries, SSH keys, or startup scripts.
7. Harvest application configuration files, credentials, database connection strings, and content data.
8. Modify or deface published content, deploy malware, pivot to adjacent systems, or use the server for further attacks.

How to detect it

Investigate web server access logs, error logs, CGI logs, reverse proxy logs, WAF alerts, EDR telemetry, process creation logs, shell history, cron directories, web root file changes, and outbound network telemetry. Focus on unauthenticated POST requests to Movable Type CGI/XML-RPC/admin endpoints, especially requests containing shell metacharacters, encoded command separators, or payloads that invoke system utilities. Correlate suspicious HTTP requests with process creation where web server, CGI, Perl, or Movable Type processes spawn `/bin/sh`, `bash`, `cmd`, `curl`, `wget`, `perl`, `python`, `chmod`, `chattr`, or archive utilities. Look for outbound HTTP, DNS, or TCP connections immediately after suspicious requests, newly written executable files in `/tmp`, `/var/tmp`, web-accessible directories, Movable Type plugin/static directories, or CGI directories, and unexpected cron jobs or SSH authorized keys. Because the exact exploit vector is unspecified publicly in the supplied details, detection should combine endpoint-specific log review with generic command-injection and post-exploitation hunting. Treat any successful command execution indicators as compromise and perform full incident response, including credential rotation and integrity review of published content and application files.

• /mt.cgi
• /mt-xmlrpc.cgi
• /cgi-bin/mt.cgi
• /cgi-bin/mt/mt.cgi
• /cgi-bin/mt/mt-xmlrpc.cgi
• POST /mt-xmlrpc.cgi
• POST /cgi-bin/mt/mt-xmlrpc.cgi
• ;id
• |id
• `id`
• $(id)
• ;whoami
• |whoami
• `whoami`
• $(whoami)
• ;uname -a
• /bin/sh -c
• bash -c
• curl http
• curl -fsSL
• wget http
• wget -O
• chmod +x
• /tmp/
• /var/tmp/
• perl -e
• python -c
• python3 -c
• nc -e
• /bin/bash
• /bin/sh
• crontab -e
• /etc/cron.d/
• /var/spool/cron/
• authorized_keys

What your security team should do

• Immediately inventory all Movable Type, Movable Type Advanced, and Movable Type Premium installations, including legacy and end-of-life deployments.
• Prioritize internet-facing instances for emergency upgrade, isolation, or decommissioning due to weaponized exploit availability and high EPSS probability.
• Restrict Movable Type admin, CGI, and XML-RPC endpoints to trusted networks or VPN until patching and investigation are complete.
• Hunt for evidence of exploitation before assuming patching alone is sufficient, especially on systems exposed prior to remediation.
• Search web server logs for suspicious requests containing shell metacharacters, command-execution probes, downloader commands, or requests to Movable Type CGI endpoints followed by outbound connections.
• Review host telemetry for web server or CGI processes spawning shells, interpreters, download tools, or permission-changing commands.
• Inspect web roots, plugin directories, temporary directories, and CGI directories for recently modified or unexpected files.
• Rotate application, database, SSH, API, and CMS administrator credentials that may have been accessible from the affected server.
• Block unnecessary outbound egress from Movable Type servers to reduce payload download and callback capability.
• Replace unsupported end-of-life Movable Type deployments with supported versions rather than relying only on compensating controls.