Portcullis Security Advisory 06-034

Portcullis Security Advisory 06-034

Vulnerable System:

Movable Type

Vulnerability Title:

The blog directory path can be set to any arbitrary directory path during the creation of new blogs.

Vulnerability discovery and development:

Portcullis Security Testing Services.

Credit for Discovery:

Tim Brown - Portcullis Computer Security Ltd.

Affected systems:

All known versions of Movable Type, this vulnerability was discovered for version 3.16.

Details:

Assuming the account that the user is logged in with has sufficient permissions to create new blogs, then a blog can be created with any arbitrary directory path.

Impact:

An attacker could use this in combination with the upload mechanism issue below to upload SSH private keys into the web server system users home directory, overwrite existing CGI scripts, deface other web sites on the web server or carry out any other attack which requires the modification of files on the web server. This is especially dangerous if the web server system user has administrative permission which allow it to access any directory and write to any file.

Exploit:

Exploit code is not required.

Copyright:

Copyright © Portcullis Computer Security Limited 2005, All rights reserved worldwide.
Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.