Portcullis Security Advisory 06-036


Vulnerable System:

Movable Type


Vulnerability Title:

A potential phishing attack via the comments mechanism.


Vulnerability Discovery And Development:

Portcullis Security Testing Services


Credit for Discovery:

Tim Brown - Portcullis Computer Security Ltd.


Affected systems:

All known versions of Movable Type, the vulnerability was discovered for version 3.16.


Details:

By posting a comment to an entry on a blog, it is possible to create URLs within the web server domain which actually forward anyone who requests them to a URL on another web server by entering a URL with the comment.  Comments that include a URL will be added to the blog entry with the URL encoded as http://webserver/path/to/mt-comments.cgi?__mode=red;id=<id> which forwards any user who requests the URL using JavaScript to the URL referenced by the id.


Impact:

By forwarding this URL, which may be seen as trusted an attacker may be able to lure its recipients to a malicous site of their creation.


Exploit:

Exploit code is not required.


Copyright: 

Copyright © Portcullis Computer Security Limited 2005, All rights reserved worldwide.
Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.


Disclaimer: 

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.