PT-2013-1055 · Six Apart · Movable Type

Takeshi Nick Osanai · Published 2013-01-23 · Updated 2013-01-29 · CVE-2013-0209

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Movable Type versions 4.2x through 4.38

Description The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely. Specifically, in Movable Type, the lib/MT/Upgrade.pm file in mt-upgrade.cgi does not require authentication for requests to database-migration functions. This allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, such as an eval injection attack against the core drop meta for table function. This can lead to the execution of arbitrary Perl code.

Recommendations For Movable Type versions 4.2x through 4.38, consider restricting access to the mt-upgrade.cgi script until a patch is available. As a temporary workaround, ensure that authentication is required for all requests to database-migration functions to prevent unauthorized access.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2015-01309

CVE-2013-0209

DSA-2611-1

Affected Products

Movable Type

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/movabletype_upgrade_exec.rb · Exploit
• 🔥 http://sec-1.com/blog/?p=402 · Exploit
• 🔥 https://exploit-db.com/exploits/24321 · Exploit
• 🔥 http://sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0209 · Security Note
• http://movabletype.org/2013/01/movable_type_438_patch.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01309 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-0209 · Security Note
• http://debian.org/security/dsa-2611 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0209 · Note
• http://openwall.com/lists/oss-security/2013/01/22/3 · Note