PT-2017-9057 · Opera · Opera
Published
2017-01-26
·
Updated
2017-01-27
·
CVE-2016-6908
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Opera versions 37.0.2192.105088
Description
The issue arises from the mishandling of certain Unicode characters, such as U+FE70, U+0622, U+0623, which can lead to a spoofed URL when combined with the first strong character, like an IP address or alphabet. By placing neutral characters, like "/" or "?", in the filepath, the URL can be flipped and displayed from Right To Left. The URL must start with an IP address followed by neutral characters, as the omnibox considers IP addresses as a combination of punctuation and numbers, and the lack of proper LTR direction enforcement causes the entire URL to be treated and rendered from RTL. However, it's not necessary for the URL to begin with an IP address; what matters is that the first strong character in the URL must be an RTL character.
Recommendations
For Opera version 37.0.2192.105088, consider avoiding the use of RTL characters as the first strong character in URLs to minimize the risk of spoofing. As a temporary workaround, restrict the use of neutral characters in filepaths to prevent URL flipping. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Opera