{"id":119440,"date":"2024-08-13T15:43:13","date_gmt":"2024-08-13T13:43:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0"},"modified":"2024-08-13T15:43:13","modified_gmt":"2024-08-13T13:43:15","slug":"uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","title":{"rendered":"S\u00e5rbarhed i web-browsere, der muligg\u00f8r angreb p\u00e5 lokale tjenester via IP 0.0.0.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Oligo Security har offentliggjort oplysninger om en s\u00e5rbarhed, der p\u00e5virker Chrome, Firefox og Safari, og som muligg\u00f8r omg\u00e5else af adgangsbegr\u00e6nsninger til netv\u00e6rkstjenester, der kun er tilg\u00e6ngelige p\u00e5 det lokale system, ved at f\u00e5 adgang til IP-adressen 0.0.0.0. De f\u00f8rste advarsler om s\u00e5rbarheden blev offentliggjort for 18 \u00e5r siden, men problemet er stadig ikke blevet l\u00f8st. <\/p>\n

S\u00e5rbarheden, som kun viser sig p\u00e5 Linux og macOS, skyldes, at IP-adressen 0.0.0.0 p\u00e5 disse platforme henviser til det lokale netv\u00e6rksinterface (localhost), dvs. at en anmodning til 0.0.0.0 svarer til en anmodning til adressen 127.0.0.1. Moderne browsere har v\u00e6rkt\u00f8jer til at modvirke adgang til 127.0.0.1, n\u00e5r de arbejder med eksterne websteder, da det kan bruges til manipulation af interne tjenester p\u00e5 brugerens system, som kun er tilg\u00e6ngelige for lokale applikationer. <\/p>\n

S\u00e5rbarheden muligg\u00f8r omg\u00e5else af forbuddet mod adgang til 127.0.0.1 og organisering af angreb p\u00e5 interne tjenester ved at \u00e5bne en ekstern side i browseren, som kontrolleres af angriberen. N\u00e5r der henvises til 0.0.0.0, kan mekanismerne CORS (Cross-Origin Resource Sharing) og PNA (Private Network Access) ikke forhindre udf\u00f8relsen af s\u00e5danne angreb. Det bem\u00e6rkes, at problemet ikke er s\u00e5 harml\u00f8st, som det ser ud til, og det allerede bliver udnyttet af kriminelle i virkelige angreb, der udnytter kritiske s\u00e5rbarheder i serverapplikationer, som kun er \u00e5bne for det lokale system.

\"S\u00e5rbarhed\"S\u00e5rbarhed<\/center> <\/p>\n

For eksempel er brug af 0.0.0.0 til adgang til lokale tjenester blevet registreret i angrebene ShadowRay og Selenium Grid, der blev identificeret i marts og juli, og som blev brugt til at organisere kodeudf\u00f8relse p\u00e5 udvikleres systemer. I tilf\u00e6lde af ShadowRay-angreb var m\u00e5let udviklersystemer, der brugte AI-rammev\u00e6rket Ray. Det andet angreb var rettet mod udnyttelse af en kritisk s\u00e5rbarhed i Selenium Grid-platformen i konfigurationer, der kun accepterer anmodninger fra localhost. <\/p>\n

Derudover n\u00e6vnes muligheden for at anvende metoden til at udnytte s\u00e5rbarheden ShellTorch i serveren<\/a> PyTorch TorchServe, der anvendes p\u00e5 computere hos udviklere af AI-applikationer. Adgang til netv\u00e6rkstjenester p\u00e5 localhost kan ogs\u00e5 bruges til at scanne netv\u00e6rksporte for indirekte identifikation af brugeren. <\/p>\n

Firefox-udviklerne har forberedt en \u00e6ndring af specifikationen for Fetch-kald, der forbyder adgang til 0.0.0.0, men har endnu ikke defineret tidspunkter for, hvorn\u00e5r blokeringen tr\u00e6der i kraft i browseren. I Chrome planl\u00e6gger de at begynde at blokere adgangen til 0.0.0.0 i udgaven Chrome 128, der forventes lanceret n\u00e6ste uge. I Safari planl\u00e6gger de at implementere blokeringen af 0.0.0.0 i udgaven Safari 18.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Oligo Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Chrome, Firefox \u0438 Safari, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0443 0.0.0.0. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0435\u0449\u0451 18 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u043d\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a \u0438 \u043d\u0435 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119441,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119440","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i web-browsere, der muligg\u00f8r angreb p\u00e5 lokale tjenester via IP 0.0.0.0 | ProHoster","description":"Oligo Security har offentliggjort information om en s\u00e5rbarhed, der p\u00e5virker Chrome, Firefox og Safari, som giver mulighed for at omg\u00e5 adgangen til netv\u00e6rkstjenester, der kun er tilg\u00e6ngelige p\u00e5 det lokale system, via.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 web-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0447\u0435\u0440\u0435\u0437 IP 0.0.0.0 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Oligo Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Chrome, Firefox \u0438 Safari, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-13T13:43:15+00:00","article:modified_time":"2024-08-13T13:43:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119440","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:01:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:52:19","updated":"2026-02-09 22:01:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/119440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=119440"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/119440\/revisions"}],"predecessor-version":[{"id":160058,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/119440\/revisions\/160058"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/119441"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=119440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=119440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=119440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}