Opera Software ASA

Severity

Moderate

Problem description

Pages displayed inside an iframe will inherit the character encoding of the parent page, unless they specify their own character encoding.

A malicious page that uses the UTF-7 character encoding can include other sites, for example inside iframes. This can be exploited to perform cross-site scripting on certain sites, allowing the attacker to get access to the user's session data for those sites.

To exploit this vulnerability, the attacker must get the user to access a specially crafted Web page.

Opera's Response

Opera has released Opera 9.20, which restricts character encoding inheritance so that it is only applied to content from the same site as the parent document.

Credits

Thanks to Stefan Esser for making Opera Software aware of this vulnerability.