CVE-2009-3013

Vulnerability

Opera versions 9.52 and earlier, as well as 10.00 Beta 3 Build 1699, do not properly block data: URIs in Location headers within HTTP responses. This allows an attacker to inject a Location header containing JavaScript sequences in a data:text/html URI, or to persuade a user to manually enter such a URI [1][2].

Exploitation

The attacker needs to control or manipulate an HTTP response that includes a Location header. The attack can occur either via a server-side redirector that reflects attacker-controlled input into the Location header, or by tricking the user into navigating to a crafted data:text/html URI containing JavaScript. The attacker does not require prior authentication to the target site; the vector relies on the browser’s failure to block the data: scheme in Location headers [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript code in the context of the data: URI. Notably, the JavaScript executes outside the context of the original HTTP site, so cookies and other site-specific data from the target domain are not directly accessible. However, the attacker can still perform phishing attacks, inject arbitrary content into the browser window, or conduct other client-side attacks that do not require same-origin access [1].

Mitigation

Opera Software released a fix in Opera 9.63 and later versions. Users should upgrade to a supported version (9.63 or later) to remediate the issue. As of the publication date, no workaround other than upgrading is available. The issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1][2].