Oligo Security has released information about a vulnerability affecting Chrome, Firefox, and Safari, which enables bypassing access restrictions to network services available only on the local system through requests to IP address 0.0.0.0. Initial warnings about this vulnerability were published 18 years ago, but the issue remains unaddressed.
The vulnerability, which appears only in Linux and macOS, is due to the fact that IP address 0.0.0.0 on these platforms directs requests to the local network interface (localhost), meaning a request to 0.0.0.0 is equivalent to a request to address 127.0.0.1. Modern browsers have implemented measures to counter requests to 127.0.0.1 when accessing external sites, as it can be exploited to manipulate internal services available only to local applications.
This vulnerability allows bypassing the restriction on accessing 127.0.0.1 and facilitates attacks on internal services when an external page controlled by the attacker is opened in the browser. Requests made through 0.0.0.0 can circumvent CORS (Cross-Origin Resource Sharing) and PNA (Private Network Access) mechanisms, enabling such an attack. It is noted that the problem is more serious than it appears and has already been used by malicious actors in real attacks exploiting critical vulnerabilities in server applications that are accessible only to the local system.
For example, the use of 0.0.0.0 to access local services was noted in attacks ShadowRay and Selenium Grid identified in March and July, which were used to execute code on developers' systems. In the ShadowRay attack, the target was developers using the AI framework Ray. The second attack was aimed at exploiting a critical vulnerability in the Selenium Grid platform in configurations that accept requests only from localhost.
Additionally, there is mention of the possibility of using this method to exploit the ShellTorch vulnerability in server PyTorch TorchServe, used on AI application developer computers. Access to local host network services can also be used for scanning network ports for indirect user identification.
Firefox developers have prepared a specification change for the Fetch call that prohibits access to 0.0.0.0, but have not yet determined when this block will be implemented in the browser. Chrome plans to start blocking access to 0.0.0.0 in version 128, expected next week. Safari plans to implement the block in version 18.
Source: opennet.ru
