Security Hole in MoveableType

It was found today that MoveableType has a hole in mt-send-entry.cgi which allows an attacker to add multiple recipients... which means they can use your blog as a spam relay. Oh how quaint.

The fix:

Solution 1: Add the following code to only allow one recipient right after the unless() block in the eval function:


# davel fix: disallow multiple $to recipients
if ( ($to =~ tr/@//) > 1 ) {
print $q->redirect($redirect);
exit;
}


Solution 2: Add the following code right after the use strict; line to disable the script:


print "Content-Type: text/html\n\n";
print "Disabled for security reasons";
exit;


I haven't seen a fix yet from MoveableType, nor have I seen anyone do a code audit to check for similar attack vectors in other scripts. Keep alert, hopefully there will be a vendor patch soon for any and all holes relating to this.