Musings

More MT Spam Vulnerabilities

I think we got us a theme going…

Remember insecure formmail scripts? How very 1990s, eh?

As if comment spam were not bad enough, MovableType includes, in its default installation, a CGI script called mt-send-entry.cgi which — you guessed it! — can be used to send email anonymously to anyone in the world.

And, no, this is not a merely theoretical issue; it’s being actively exploited by spammers.

Ben Trott has proposed the following patch to address the issue

--- mt-send-entry.cgi.orig      Sun Nov 23 20:21:12 2003
+++ mt-send-entry.cgi   Sun Nov 23 21:23:48 2003
@@ -37,6 +37,8 @@
         die "Missing required parameters\n";
     }
 
+    die "Invalid from or to value"
+       if $to =~ /[\r\n]/ || $from =~ /[\r\n]/;
     my $entry = MT::Entry->load($entry_id)
         or die "Invalid entry ID '$entry_id'";
     my $blog = MT::Blog->load($entry->blog_id);

But that addresses only one of the various ways in which this script can be exploited. Spammers can still send as much email as they want, with arbitrary message body content, to whomever they want, and do so completely anonymously. The only thing they can’t get rid of is the subject line

Subject: [Your Blog Name] Recommendation: Your Entry Title

which serves only to sully your reputation, and the first line of the message body,

Some fake email address has sent you a link!

(The link to your blog entry itself — at the bottom of the message body — is easily omitted, not that anyone will care.)

Unless you feel you absolutely must use this CGI script to allow anonymous visitors to mail arbitrary messages to whomever they please, you’d be much better off simply disabling it. Change the permissions on the offending script to make it inexecutable, or remove it entirely.

Do it now, before your blog is exploited by spammers.

Update (11/26/2003): Ben Trott has posted a message warning the vast majority of MT users, who don’t use this CGI script, to disable/remove it. He’s also posted an improved version (better than the patch above, but still only “spam-resistant”, rather than “spam-proof”) of the script.