[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Oct 2008 01:52:13 +0200
From: "avivra" <avivra@...il.com>
To: "'Stefano Di Paola'" <stefano.dipaola@...ec.it>,
"'Roberto Suggi'" <roberto.suggi@...urity-assessment.com>,
<full-disclosure@...ts.grok.org.uk>
Subject: Re: Opera Stored Cross Site Scripting
Hi,
Just found a way to use Stefano's opera:config idea to execute code from
remote.
Instead of changing the HTTP Proxy, an attacker can change the default
external mail application to "\\evil\malware.exe ", or to local commands
(e.g. ftp.exe which can be used to download malicious binaries from remote).
Also, there is a need to change the "Mail Handler" settings to "2", so opera
will execute the external mail application, instead of the default opera
mail application.
After changing the settings, the attacker can simply set the location to
"mailto:" to execute the code.
A proof-of-concept which executes the Windows Calculator can be found here:
http://raffon.net/research/opera/history/op.html
Cheers,
--Aviv.
http://aviv.raffon.net
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists