Portcullis Security Advisory - 06-033

Portcullis Security Advisory - 06-033

Vulnerable System:

Movable Type

Vulnerability Title:

The username and password hash for the administration interface is stored within a cookie.

Vulnerability Discovery And Development:

Portcullis Security Testing Services.

Credit For Discovery:

Tim Brown - Portcullis Computer-Security Ltd.

Affected systems:

All known versions of Movable Type, the vulnerability discovered was for version 3.16.

Details:

Following a successful login to the administration interface, the cookie mt_user is set. This cookie contains the string <account username>::<account password hash>::<remember flag> and is accessible to any page requested from within the same directory as the mt.cgi CGI script. This string will expire at the end of the users session where the remember flag is set to 0 during the initial login, or in 10 years time where the remember flag is set to 1 during the inital login.

Impact:

Should an attacker succeed in grabbing this cookie (either via Cross-site Scripting(XSS) as described above, interception during transmission or from the user's browser), they will be able to successfully login, until such time as the password for this account is changed either by setting a similar cookie in their browser, or by modifying their requests through a Man-In-The-Middle proxy.

Exploit:

Exploit code is not required.

Copyright:

Copyright © Portcullis Computer Security Limited 2005, All rights reserved worldwide.
Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.