CVE-2021-20837
CRITICAL EXPLOITED IN THE WILD NUCLEIMovable Type < 1.46, 4.0-6.3.11, 6.5.0-6.8.2 - Remote Code Execution via XMLRPC API
Title source: llmExploitation Summary
CVE-2021-20837 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 6 public exploits from researchers including Charl-Alexandre Le Brun, orangmuda, ghost-nemesis. A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Movable Type's XMLRPC API (CVE-2021-20837) by sending a crafted XML payload containing a base64-encoded command. The exploit checks for vulnerability by verifying the presence of a fingerprint in the response and executes the payload if vulnerable.
Description
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
Exploits (6)
This Metasploit module exploits a command injection vulnerability in Movable Type's XMLRPC API (CVE-2021-20837) by sending a crafted XML payload containing a base64-encoded command. The exploit checks for vulnerability by verifying the presence of a fingerprint in the response and executes the payload if vulnerable.
This repository contains a functional Metasploit module for CVE-2021-20837, which exploits a remote command injection vulnerability in Movable Type's XMLRPC API. The exploit crafts a malicious XML payload to execute arbitrary commands via the `mt.handler_to_coderef` method.
This repository contains a functional Metasploit module for CVE-2021-20837, which exploits a remote command injection vulnerability in Movable Type's XMLRPC API. The exploit crafts a malicious XML payload to execute arbitrary commands via the `mt.handler_to_coderef` method.
This repository contains a functional Metasploit module for CVE-2021-20837, which exploits a remote command injection vulnerability in Movable Type's XMLRPC API. The exploit crafts a malicious XML payload to execute arbitrary commands via the `mt.handler_to_coderef` method.
This repository contains a functional exploit for CVE-2021-20837, an unauthenticated RCE vulnerability in MovableType. The exploit leverages the `mt.handler_to_coderef` method in the XML-RPC interface to execute arbitrary OS commands via a base64-encoded payload.
The repository contains only a minimal README with a CVE title and no functional exploit code or technical details. It lacks any meaningful content to demonstrate or analyze the vulnerability.
Nuclei Templates (1)
http.title:"サインイン | movable type pro" || cpe:"cpe:2.3:a:sixapart:movable_type"
title="サインイン | movable type pro"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H