> JapanHacked_
[Resolved][Severity: Moderate][Web app exploit]

Sunmedia: its website was accessed without authorization and defaced, through a vulnerability in leftover old MovableType files

A vulnerability in leftover old MovableType files was exploited and the top page and other files were altered. The web server held no personal data.

Disclosed

2021-11-10

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Around 9:00, a contractor found an anomaly on the site and blocked a German IP address. The index file and some WordPress files had been rewritten. [1] [2]

  2. It published the course of events and the cause. [1] [2]

Cause and impact

The cause was old MovableType files left on the server. A vulnerability in the XMLRPC API allowing OS command injection (JVN#41119755) was exploited. The old files were deleted. No personal data was stored on the web server, so nothing leaked. [1] [2]

Timeline

  1. Started, Detected 2021-11-07
  2. Disclosed 2021-11-10
  3. 3 days

Attack or cause

Method
[Web app exploit]
Impact
[Site defacement]
Entry point
Web app

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]弊社ホームページへの不正アクセスと改ざんの経緯と原因、今後の対策についてSunmedia Co., Ltd. · 2021-11-10
  2. [2][News]サンメディアWebサイトに不正アクセス、11/5公表のMovableTypeの脆弱性を悪用ScanNetSecurity · 2021-11-16 08:05