Opera: Location, Location, Location (GM#008-OP)

[GreyMagic Software]

GreyMagic Security Advisory GM#008-OP
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

By GreyMagic Software, 05 Aug 2004.

Available in HTML format at
http://www.greymagic.com/security/advisories/gm008-op/.

Topic: Location, Location, Location.

Discovery date: 19 Jul 2004.

Affected applications:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D

Opera 7.53 and prior on Windows, Linux and Mac.=20


Introduction:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

On 04-Feb-2003 GreyMagic released an advisory [1] concerning Opera's
security model in v7.0. The advisory depicted several flaws in Opera's
model, one of them allowed for an attacker to overwrite native and custom
functions in a victim window. When the victim web-page executed such
function, the attacker's code executed with the victim's privileges.=20

Opera tried to prevent such scenarios in Opera 7.01, by blocking
write-access to objects on the victim window.=20

[1] http://www.greymagic.com/security/advisories/gm002-op/

Discussion:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Unfortunately, Opera failed to block write-access to the often-used
"location" object.=20

By overwriting methods in this object, an attacker can gain immediate scr=
ipt
access to any web-page that uses one of these methods. This includes both
web-pages in foreign domains and the victim's local file system.=20

The impacts of this vulnerability include:=20

* Read-access to files on the victim's file system=20
* Read-access to lists of files and folders on the victim's file system=20
* Read-access to emails written or received by M2, Opera's mail program=20
* Cookie theft=20
* URL spoofing (phishing)=20
* Track user browsing history=20
* Much more...=20

Several methods are candidates for such attacks: assign(), replace(),
valueOf() and toString(). The first two would be triggered only when the
victim explicitly calls them. The latter ones would be called in many
implicit cases, including:=20

* str+=3Dlocation;
* decodeURI(location);
* location*7;
* location+"";

And many others...=20

In order to gain access to the "file://" protocol, and hence to the entir=
e
file-system, an attacker needs to know of an HTML file in the victim's fi=
le
system that actually makes a call to a method in the location object. Suc=
h
file was included in virtually all Windows Operating Systems, it is named
"CiAdmin.htm" and it can be found in a very predictable path -
%SystemRoot%/Help/.=20


Exploit:=20
=3D=3D=3D=3D=3D=3D=3D=3D

To exploit this vulnerability an attacker can use a simple <iframe>,
pointing to the victim web-page, and inject the malicious code into its
window. Here's an oversimplified example:=20

<iframe src=3D"blank.html"></iframe>
<script type=3D"text/javascript">
onload=3Dfunction () {
=A0=A0=A0=A0var oVictim=3Dframes[0];
=A0=A0=A0=A0oVictim.location.href=3D"file://localhost/c:/winnt/help/ciadm=
in.htm";
=A0=A0=A0=A0oVictim.location.replace=3Dfunction () {
=A0=A0=A0=A0=A0=A0=A0=A0oVictim.alert("We now have full file system acces=
s using
"+location.href);
=A0=A0=A0=A0}
}
</script>

This code demonstrates how the vulnerability works, but it is not likely =
to
succeed in exploiting it by itself. This happens because the malicious co=
de
must be injected in the time-gap between page initiation and page script
execution. This leaves a very narrow window for an attacker to inject cod=
e,
but with a bit of scripting this window of opportunity can easily be foun=
d.
The demonstrations linked below use simple brute-force and retry mechanis=
ms
to inject our code successfully.=20


Demonstration:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

GreyMagic prepared two proof-of-concept demonstrations of this
vulnerability, they are available at
http://www.greymagic.com/security/advisories/gm008-op/.


Solution:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D

GreyMagic informed Opera of the vulnerability on 22-Jul-2004. A new versi=
on
(7.54) was officially released on 05-Aug-2004 to address this flaw.


Tested on:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Opera 7.52.
Opera 7.53.


Disclaimer:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The information in this advisory and any of its demonstrations is provide=
d
"as is" without warranty of any kind.=20

GreyMagic Software is not liable for any direct or indirect damages cause=
d
as a result of using the information or demonstrations provided in any pa=
rt
of this advisory.=20

- Copyright =A9 2004 GreyMagic Software.