CVE-2009-2351

Vulnerability

Opera 9.52 and earlier versions, as well as 10.00 Beta 3 Build 1699, do not properly block javascript: URIs in Refresh headers of HTTP responses [1][2]. This allows a remote attacker to inject a Refresh header (e.g., via a vulnerable script) or specify its content, leading to cross-site scripting (XSS) attacks. The vulnerability is a variant of CVE-2009-1312.

Exploitation

An attacker needs to find a web application that reflects user input into a Refresh header or allows setting the Refresh header value. The attacker crafts a request that causes the server to respond with a Refresh: 0; URL=javascript:alert(document.cookie) header [2]. When the browser processes this header, it executes the JavaScript code in the context of the vulnerable site.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the security context of the vulnerable website. This can lead to cookie theft, session hijacking, phishing, or other malicious actions [1]. The attacker does not require any special privileges; the attack works on standard HTTP responses.

Mitigation

As of the publication date (2009-07-07), no official fix was available from Opera for the affected versions. Users should upgrade to a patched version if available; however, the references do not specify a fixed release. Blocking javascript: URIs in Refresh headers via a proxy or web application firewall may reduce risk. The issue was later addressed in subsequent Opera versions, but specifics are not provided in the cited references.