CVE-2018-0645
📋 TL;DR
MTAppjQuery 1.8.1 and earlier contain an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary PHP code on affected systems. This affects websites using vulnerable versions of the MTAppjQuery plugin for Movable Type. Attackers can compromise the entire web server through this vulnerability.
💻 Affected Systems
- MTAppjQuery
📦 What is this software?
Mtappjquery by Bit Part
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, defacement, malware distribution, or use as part of a botnet.
Likely Case
Website defacement, data exfiltration, or installation of backdoors for persistent access.
If Mitigated
Limited impact if file uploads are restricted or web application firewalls block malicious uploads.
🎯 Exploit Status
Exploitation involves uploading malicious PHP files through the vulnerable plugin interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.2 or later
Vendor Advisory: https://bit-part.net/news/2018/07/mtappjquery-20180717.html
Restart Required: No
Instructions:
1. Download MTAppjQuery 1.8.2 or later from the official repository. 2. Replace the existing MTAppjQuery plugin files with the updated version. 3. Verify the plugin version in Movable Type's plugin management interface.
🔧 Temporary Workarounds
Disable MTAppjQuery Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
Navigate to Movable Type admin panel > Plugins > Disable MTAppjQuery
Restrict File Uploads
linuxConfigure web server to block PHP file uploads through the plugin's upload directory.
Add 'Deny from all' to .htaccess in MTAppjQuery upload directory
🧯 If You Can't Patch
- Implement web application firewall rules to block malicious file upload patterns
- Monitor file system for unauthorized PHP file creation in upload directories
🔍 How to Verify
Check if Vulnerable:
Check Movable Type plugin list for MTAppjQuery version 1.8.1 or earlier.Check Version:
Check Movable Type admin panel: System > PluginsVerify Fix Applied:
Confirm MTAppjQuery version is 1.8.2 or later in plugin management.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to MTAppjQuery directories
- Execution of unexpected PHP files
Network Indicators:
- HTTP POST requests to MTAppjQuery upload endpoints with PHP file extensions
SIEM Query:
source="web_server" AND (uri_path="/mtappjquery/upload" OR file_extension=".php")🔗 References
- http://jvn.jp/en/jp/JVN62423700/index.html
- http://www.tinybeans.net/blog/2015/06/26-230919.html
- https://bit-part.net/news/2018/07/mtappjquery-20180717.html
- http://jvn.jp/en/jp/JVN62423700/index.html
- http://www.tinybeans.net/blog/2015/06/26-230919.html
- https://bit-part.net/news/2018/07/mtappjquery-20180717.html
