CVE-2022-43660

Vulnerability

Movable Type suffers from an improper neutralization of Server-Side Includes (SSI) within a web page, identified as CVE-2022-43660. The vulnerability exists due to insufficient sanitization of user-supplied input in content types, allowing the injection of SSI directives. Affected versions include Movable Type 7 r.5301 and earlier (7 Series), Movable Type Advanced 7 r.5301 and earlier (Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier [1].

Exploitation

An attacker must be authenticated and possess the 'Manage of Content Types' privilege. By crafting malicious SSI directives within a content type, the attacker can inject arbitrary Perl script or OS commands. The attack does not require user interaction and can be performed over the network with low complexity [1].

Impact

Successful exploitation allows the attacker to execute arbitrary Perl scripts or OS commands on the server. This leads to a full compromise of confidentiality, integrity, and availability, as the attacker can read, modify, or delete data, install malware, or pivot to other systems [1].

Mitigation

Six Apart released fixes in Movable Type 7 r.5401 (v7.9.6) and Movable Type Advanced 7 r.5401 (v7.9.6) on November 16, 2022. Users are strongly advised to upgrade to these versions or later. For Movable Type Premium and Premium Advanced, corresponding updates should be applied as provided by the vendor. No workarounds are documented [2].