CVE-2020-5577

Vulnerability

Movable Type series (including Movable Type 7 r.4606 (7.2.1) and earlier, Movable Type Advanced 7 r.4606 (7.2.1) and earlier, Movable Type for AWS 7 r.4606 (7.2.1) and earlier, Movable Type 6.5.3 and earlier, Movable Type Advanced 6.5.3 and earlier, Movable Type 6.3.11 and earlier, Movable Type Advanced 6.3.11 and earlier, Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) contains an unrestricted upload of files with specific extensions vulnerability (CWE-434) [1]. This allows remote authenticated attackers to upload arbitrary files and execute a PHP script via unspecified vectors [1].

Exploitation

An attacker must have valid authentication credentials to the Movable Type system. No additional user interaction is required. The attacker can upload a specially crafted PHP file to the server, which can then be executed remotely [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the server, leading to potential disclosure of sensitive information, modification of data, or denial of service. The CVSS v3 base score is 6.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L [1].

Mitigation

Six Apart released fixed versions: Movable Type 7 r.4607 (v7.3.0), Movable Type 6.6.0, and Movable Type 6.3.12 [2]. Users should upgrade to the latest versions. If upgrading is not possible, restrict file upload capabilities to trusted users only.