[NT] Phantom of the Opera (Opera Error Handling Executes Commands)
From: support@securiteam.com
Date: 02/10/03
- Previous message: support@securiteam.com: "[TOOL] Resources for Combating the Slammer Worm"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: 10 Feb 2003 15:22:13 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
Beyond Security would like to welcome Tiscali World Online
to our service provider team.
For more info on their service offering IP-Secure,
please visit http://www.worldonline.co.za/services/work_ip.asp
- - - - - - - - -
Phantom of the Opera (Opera Error Handling Executes Commands)
------------------------------------------------------------------------
SUMMARY
Opera recently released a new version of its browser.
Version 7 brings many long-awaited features such as proper DOM support and
an improved rendering engine. Among the useful new features, Opera added a
shiny new JavaScript console. The console is mainly used by developers in
order to efficiently track down exceptions in running scripts.
A vulnerability in the way the exceptions are handled allows an attacker
to cause them to execute arbitrary code in elevated privileges.
DETAILS
Vulnerable systems:
* Opera version 7 on Windows operating system
Immune systems:
* Opera version 7.01 on Windows operating system
Opera's JavaScript console is using three html files residing in Opera's
installation directory. The most important of them is "console.html",
which contains all the logic behind the console.
The console lists unhandled exceptions that are thrown during the life of
a session. JavaScript can throw custom exceptions using the "throw"
statement and Opera adds its own way to create debug messages with the
"opera.postError" method.
In order to display clickable URLs properly, Opera does some formatting on
the thrown exception message to turn them into links:
newmsg = msg.replace( /</g, "<" ).
replace( />/g, ">" ).
replace( /https?:\/\/\S+/g, create_link ).
replace( /file:\/\/(?:\S|(?:[ ](?=[^\n\r]*\.)))+/g,
create_link );
The first two lines supposedly handle the safety of this string, so it
would not contain HTML. The last two lines are meant to transform strings
that appear like URLs into actual links. Unfortunately, each of these last
two lines contains an obvious way for an attacker to inject his own
attributes to the link. By doing so, the attacker can gain access to the
file:// protocol, which, among others, has the following implications:
* Read any file on the user's file system.
* Read the contents of directories on the user's file system.
* Read emails written or received by M2, Opera's mail program.
The first vulnerable regular expression is /https?:\/\/\S+/g, it is trying
to match anything starting with "http://" or "https://" and keeps
consuming characters as long as they are not whitespace. This regular
expression does not check for the existence of quotes, which are the
delimiters of the "href" attribute in the resulting link, and therefore
opens up a way to add additional attributes (spaces between attributes are
not mandatory).
The second vulnerable regular expression is /file:\/\/(?:\S|(?:[
](?=[^\n\r]*\.)))+/g, it's trying to match anything starting with
"file://" followed by a non-whitespace character or a regular space, as
long as a dot appears and no line breaks appear after it. The same mistake
is made again; quotes can be used to add additional attributes to the
link.
Being able to add arbitrary attributes to a link may seem innocent, but
with a little manipulation, it leads to the execution of arbitrary script
code. The "style" attribute in most elements, for example, may contain
properties such as "background-image", which normally point to a URL. That
URL can be "javascript:[code]", which will be executed in the context of
the console (file:// protocol).
Exploit:
A simple exploit of the first regular expression:
open("file://localhost/console.html","","");
opera.postError("http://\"style=\"background-image:url('javascript:alert(location.href)')\"");
A simple exploit of the second regular expression:
open("file://localhost/console.html","","");
opera.postError("file://\"
style=\"background-image:url('javascript:alert(location.href)')\".");
Demonstration:
GreyMagic has put together two proof-of-concept demonstrations:
* <http://security.greymagic.com/adv/gm003-op/phSimple.asp> Simple:
Demonstrates how the poisonous debug message is being inserted.
* <http://security.greymagic.com/adv/gm003-op/phExp.asp> GreyMagic Opera
Disk Explorer: Browse your entire file system using this explorer-like
tool, which takes advantage of this vulnerability in order to access local
resources.
Solution:
Fortunately, this vulnerability can be solved manually:
* Edit the file "console.html", which resides in Opera's installation
directory.
* Line 52 should read: m.replace( /\\/g, "\\\\" ) +
* Replace it with: m.replace( /\\/g, "\\\\" ).replace(/"/g,""") +
ADDITIONAL INFORMATION
The original advisory can be found at:
<http://security.greymagic.com/adv/gm003-op/>
http://security.greymagic.com/adv/gm003-op/
The information has been provided by <mailto:security@greymagic.com>
GreyMagic Software.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Next message: support@securiteam.com: "[NT] Opera's Security Model Vulnerable to Attack"
- Previous message: support@securiteam.com: "[TOOL] Resources for Combating the Slammer Worm"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
