OS Command Injection in Six Apart Ltd products - CVE-2021-20837
Published: October 20, 2021 / Updated: March 23, 2022
Vulnerability identifier: #VU57555
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-20837
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in Movable Type XMLRPC API. A remote unauthenticated attacker can send a specially crafted message and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Movable Type
Movable Type Advanced
Movable Type Premium
Movable Type Premium Advanced
Movable Type Advanced
Movable Type Premium
Movable Type Premium Advanced
How to mitigate CVE-2021-20837
Install updates from vendor's website.
Movable Type - addressed in versions r.5003, 6.8.3
Movable Type Advanced - addressed in versions r.5003, 6.8.3
Movable Type Premium - update to 1.47
Movable Type Premium Advanced - update to 1.47
Movable Type Advanced - addressed in versions r.5003, 6.8.3
Movable Type Premium - update to 1.47
Movable Type Premium Advanced - update to 1.47
Links to Public Exploits and PoC-codes
- Exploit #7532 - CVE-2021-20837 (XMLRPC - RCE in MovableTypePoC) (March 23, 2022)
- Exploit #7201 - CVE-2021-20837 (XMLRPC - RCE in MovableTypePoC) (December 26, 2021)
- Exploit #7182 - CVE-2021-20837 (XMLRPC - RCE in MovableTypePoC) (December 16, 2021)
- Exploit #6972 - CVE-2021-20837 (MovableType XMLRPC - RCE) (November 1, 2021)
- Exploit #6939 - cve-2021-20837-poc (PoC for the CVE-2021-20837 : RCE in MovableType) (October 26, 2021)