CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Virtual Patch for Movable Types XSS (CVE 2012-1262)

My SpiderLabs Research colleague Jonathan Claudius recently identified an XSS flaw in the Movable Types application which was outlined in Trustwave Security Advisory TWSL2012-003. Here is the quick overview of the issue:

After extracting the Moveable Type CGI files and source files on to a webserver, but before the application is fully installed, cross-site scriptingvulnerabilities are present in the '/cgi-bin/mt/mt-wizard.cgi' page.Example(s):Performing XSS on "dbuser" parameter#RequestPOST /cgi-bin/mt/mt-wizard.cgi HTTP/1.1Host: A.B.C.DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1) Gecko/20100101 Firefox/8.0.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-us,en;q=0.5Accept-Encoding: gzip, deflateAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7Proxy-Connection: keep-aliveReferer: http://A.B.C.D/cgi-bin/mt/mt-wizard.cgiContent-Type: application/x-www-form-urlencodedContent-Length: 216__mode=test&step=configure&set_static_uri_to=&default_language=en-us&config=&dbtype=mysql&dbserver=localhost&dbname=&dbuser=%3Cscript%3Ealert%28%27123%27%29%3C%2Fscript%3E&dbpass=test&dbpath=&dbport=&dbsocket=&test=1#Response<--------------snip-----------><p>Connection error: Access denied for user '<script>alert('123')</script>'@'localhost' (using password: YES) at /var/www/cgi-bin/mt/extlib/Data/ObjectDriver/Driver/ line 320<--------------snip----------->

ModSecurity Virtual Patch

Here is a ModSecurity virtual patch for this issue that we added to our Commercial Rules Feed:

# (2100009) ModSecurity Rules from Trustwave SpiderLabs: Security Advisory TWSL2012-003: Cross-Site Scripting Vulnerability in Movable Type Publishing Platform
SecRule REQUEST_FILENAME "@streq /cgi-bin/mt/mt-wizard.cgi" "chain,phase:2,t:none,block,id:'2100009',msg:'SLR: Security Advisory TWSL2012-003: Cross-site Scripting Attack in Movable Type Publishing Platform.',logdata:'%{matched_var}',severity:'2',tag:'WEB_ATTACK/XSS',tag:''"
SecRule ARGS_POST:dbuser "!^[a-zA-Z0-9]+$"

This virtual patch will ensure that the "dbuser" payload on the /cgi-bin/mt/mt-wizard.cgi script only contains alphanumeric characters.


From a time-to-fix perspective, this virtual patch was created very quickly. It took me all of about 5 minutes to develop. These rules can then be implemented across an entire server farm is short order to proctect all effected applications. Think of this from the perspective of a web hosting provider. They are the most at risk of this particular issues as they often initially provision applications such as Movable Types for this end users but then these applications wait, in this insecure state, until the user completes the installations.

Contrast this expediated timeline vs. the time it took the vendor to release a patch for this issue:

Revision History:01/11/12 - Vulnerability disclosed02/21/12 - Patch released02/24/12 - Advisory published

It took them an entire month to release a patch for users.

OWASP Virtual Patching Workshop at AppSecDC

If you would like to learn more about virtual patching and try some hands on exercises, please consider joining me at the upcoming OWASP AppSecDC conference for the Virtual Patching Workshop. We will be diving in-depth on all these issues.

Latest SpiderLabs Blogs

EDR – The Multi-Tool of Security Defenses

This is Part 8 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The full series can be found here.

Read More

The Invisible Battleground: Essentials of EASM

Know your enemy – inside and out. External Attack Surface Management tools are an effective way to understand externally facing threats and help plan cyber defenses accordingly. Let’s discuss what...

Read More

Fake Dialog Boxes to Make Malware More Convincing

Let’s explore how SpiderLabs created and incorporated user prompts, specifically Windows dialog boxes into its malware loader to make it more convincing to phishing targets during a Red Team...

Read More