CVE-2019-6025

Vulnerability

Movable Type contains an open redirect vulnerability (CWE-601) in various product lines [1]. Affected versions include Movable Type 7 r.4602 (7.1.3) and earlier, Movable Type 6.5.0 and 6.5.1, Movable Type 6.3.9 and earlier (covering 6.3.x, 6.2.x, 6.1.x, 6.0.x), and corresponding Advanced and Premium editions up to the indicated versions [1]. No specific code module is named in the disclosure, but the vulnerability is triggered when a user follows a specially crafted URL that leads to an untrusted redirect destination.

Exploitation

An attacker can craft a malicious URL that, when accessed by a victim, redirects the user to an arbitrary external website [1]. The attack requires no special privileges; it depends on the victim clicking or being tricked into visiting the crafted link. The open redirect occurs on the server side, likely due to insufficient validation of redirect parameters [1]. No authentication or prior access to the system is needed for the redirect to succeed.

Impact

A successful exploit redirects the user to an arbitrary site, which an attacker can use for phishing attacks [1]. The victim may be deceived into entering credentials or other sensitive information on a fraudulent page that appears legitimate. The attack can also be used to bypass URL-based security filters or to direct users to malicious content. No code execution or data exfiltration from the Movable Type installation itself is described.

Mitigation

The vulnerability is fixed in Movable Type 7 r.4603 (7.1.4), Movable Type 6.5.2, and Movable Type 6.3.10 [2]. Users should update to these or later versions. For Movable Type 5.x and earlier, vendor support has ended and no countermeasures are provided; upgrading to a supported version (e.g., 6.5 or 7) is recommended [1]. No workaround is documented in the available references.