Security Advisory 06 – 034 – The blog directory path can be set to any arbitrary directory path during the creation of new blogs
Vulnerability discovery and development:
Portcullis Security Testing Services.
Credit for Discovery:
Tim Brown – Portcullis Computer Security Ltd.
All known versions of Movable Type, the vulnerability was discovered for version 3.16.
Assuming the account that the user is logged in with has sufficient permissions to create new blogs, then a blog can be created with any arbitrary directory path.
An attacker could use this in combination with the upload mechanism issue below to upload SSH private keys into the web server system users home directory, overwrite existing CGI scripts, deface other web sites on the web server or carry out any other attack which requires the modification of files on the web server. This is especially dangerous if the web server system user has administrative permission which allow it to access any directory and write to any file.
Exploit code is not required.