full-disclosure - Re: Opera Stored Cross Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <DA9966FCC637E843AC66318C53B744221A722D260C@whau.smb2go.net>
Date: Thu, 23 Oct 2008 22:27:40 +1300
From: Roberto Suggi <roberto.suggi@...urity-assessment.com>
To: avivra <avivra@...il.com>, "'Stefano Di Paola'" <stefano.dipaola@...ec.it>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Opera Stored Cross Site Scripting

Hi Avivra,

I have tested your PoC with Opera 9.52 and Opera 9.60 and I needed to tweak your scripts and it works. Good job!

I mostly focused on stealing history and initially I could not find a way to interact with opera:config. But apparently, appending the IFRAME to the document DOM with document.body.appendChild is the way.

Cheers,

Roberto

From: avivra [mailto:avivra@...il.com]
Sent: Thursday, 23 October 2008 12:52 p.m.
To: 'Stefano Di Paola'; Roberto Suggi; full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Opera Stored Cross Site Scripting

Hi,

Just found a way to use Stefano's opera:config idea to execute code from remote.
Instead of changing the HTTP Proxy, an attacker can change the default external mail application to "\\evil\malware.exe ", or to local commands (e.g. ftp.exe which can be used to download malicious binaries from remote). Also, there is a need to change the "Mail Handler" settings to "2", so opera will execute the external mail application, instead of the default opera mail application.
After changing the settings, the attacker can simply set the location to "mailto:" to execute the code.

A proof-of-concept which executes the Windows Calculator can be found here: http://raffon.net/research/opera/history/op.html

Cheers,
--Aviv.
http://aviv.raffon.net

Internal Virus Database is out of date.
Checked by AVG - http://www.avg.com
Version: 8.0.173 / Virus Database: 270.7.6/1711 - Release Date: 6/10/2008 5:37 p.m.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/