January 16, 2024 at 09:12AM
Vulnerability in Opera browser feature My Flow allowed remote code execution. Guardio Labs found old, vulnerable landing pages and created a proof-of-concept to execute malicious code. The issue was resolved in November 2023. Opera confirmed the vulnerability and deployed a fix. No evidence of in-the-wild exploitation was found. Opera is employing safety measures to prevent future issues.
Based on the meeting notes, the key takeaways are:
– Guardio Labs reported a vulnerability in Opera browser’s My Flow feature that could have led to remote code execution (RCE.
– The My Flow feature uses a built-in browser extension, ‘Opera Touch Background,’ which possesses broad permissions.
– Guardio Labs discovered several versions of the My Flow landing page, some lacking recent security checks, which allowed them to create a proof-of-concept (PoC) extension to download and execute a file on a victim’s computer.
– The attack required user interaction but could easily be overcome using social engineering. The vulnerability impacted Opera and Opera GX browsers on both Windows and macOS.
– The issue was resolved in November 2023 on the server side, and no evidence of in-the-wild exploitation was found.
– Opera confirmed that it was made aware of the vulnerability on November 17, and a fix was deployed by November 22. They have made changes to prevent similar problems in the future and use manual review in their add-ons store to detect and blacklist malicious extensions before reaching users.
Feel free to reach out if you need further details or additional information.