Security Advisory 06 – 033 – The username and password hash for the administration interface is stored within a cookie
Vulnerability discovery and development:
Portcullis Security Testing Services.
Credit for Discovery:
Tim Brown – Portcullis Computer Security Ltd.
All known versions of Movable Type, the vulnerability was discovered for version 3.16.
Following a successful login to the administration interface, the cookie mt_user is set. This cookie contains the string [account username]::[account password hash]::[remember flag] and is accessible to any page requested from within the same directory as the mt.cgi CGI script. This string will expire at the end of the users session where the remember flag is set to 0 during the initial login, or in 10 years time where the remember flag is set to 1 during the inital login.
Should an attacker succeed in grabbing this cookie (either via Cross-site Scripting(XSS) as described above, interception during transmission or from the user’s browser), they will be able to successfully login, until such time as the password for this account is changed either by setting a similar cookie in their browser, or by modifying their requests through a Man-In-The-Middle proxy.
Exploit code is not required.