{"id":119440,"date":"2024-08-13T15:43:13","date_gmt":"2024-08-13T13:43:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0"},"modified":"2024-08-13T15:43:13","modified_gmt":"2024-08-13T13:43:15","slug":"uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","title":{"rendered":"Veebibrauserite haavatavus, mis v\u00f5imaldab r\u00fcnnata kohalikke teenuseid IP-aadressi 0.0.0.0 kaudu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Oligo Security avaldas teavet haavatavuse kohta, mis m\u00f5jutab Chrome'i, Firefoxi ja Safari't ning v\u00f5imaldab p\u00e4\u00e4seda ligi vaid kohaliku s\u00fcsteemi piiratud juurdep\u00e4\u00e4suga v\u00f5rguteenustele, kasutades IP-aadressi 0.0.0.0. Esimesed hoiatavad teated haavatavuse kohta ilmusid juba 18 aastat tagasi, kuid probleem pole siiani lahendatud. <\/p>\n

Haavatavus, mis ilmneb ainult Linuxis ja macOS-is, tuleneb sellest, et IP-aadress 0.0.0.0 toob nendel platvormidel kaasa kohaliku v\u00f5rgu liidese (localhost) adressaadi. Teisis\u00f5nu, p\u00e4ring saatmine 0.0.0.0 on sarnane p\u00e4ringule aadressile 127.0.0.1. Kaasaegsetes brauserites on mehhanisme, mis takistavad p\u00e4\u00e4su 127.0.0.1-le v\u00e4listelt saitidelt, kuna seda v\u00f5ib kasutada, et manipuleerida kasutaja s\u00fcsteemis oleva kohalike teenustega, mis on k\u00e4ttesaadavad ainult kohalike rakenduste kaudu. <\/p>\n

H\u00e4irev\u00f5ime v\u00f5imaldab ringuda 127.0.0.1 aadresse n\u00f5udva keelu ja korraldada r\u00fcnnakud siseteenuste vastu avatud v\u00e4lise lehe kaudu, mis on r\u00fcndaja kontrolli all. 0.0.0.0 aadressi kasutamisel ei saa CORS (Cross-Origin Resource Sharing) ja PNA (Private Network Access) mehhanismid takistada selliste r\u00fcnnakute teostamist. T\u00f5detakse, et probleem ei ole nii kahjutu, nagu tundub, ja seda on juba kasutanud k\u00fcberkurjategijad, kes viivad l\u00e4bi reaalseid r\u00fcnnakuid, mis kasutavad \u00e4ra t\u00f5siseid haavatavusi serverite rakendustes, millele on juurdep\u00e4\u00e4s ainult lokaalsest s\u00fcsteemist.

\"Veebibrauserite\"Veebibrauserite<\/center> <\/p>\n

N\u00e4iteks on 0.0.0.0 kasutamine kohalike teenuste juurde p\u00e4\u00e4semiseks dokumenteeritud m\u00e4rtsis ja juulis toimunud ShadowRay ja Selenium Grid r\u00fcnnakutes, mida kasutati koodi t\u00e4itmise korraldamiseks arendajate s\u00fcsteemides. ShadowRay r\u00fcnnaku eesm\u00e4rk oli arendajate s\u00fcsteemid, mis kasutasid AI-raamistiku Ray. Teine r\u00fcnnak keskendus kriitilise haavatavuse \u00e4rakasutamisele Selenium Grid platvormis konfiguratsioonides, mis aktsepteerisid p\u00e4ringuid ainult lokaalsest hostist. <\/p>\n

Lisaks mainitakse meetodi rakendamise v\u00f5imalust haavatavuse ShellTorch \u00e4rakasutamiseks. serveril<\/a> PyTorch TorchServe, mida kasutatakse AI-rakenduste arendajate arvutites. Kohalikule hostile juurdep\u00e4\u00e4sul olevad v\u00f5rgu teenused v\u00f5ivad samuti olla kasutusel v\u00f5rguportide skaneerimiseks, et userit kaudselt tuvastada. <\/p>\n

Firefoxi arendajad on valmistanud ette muudatused Fetchi spetsifikatsioonis, mis keelavad juurdep\u00e4\u00e4su 0.0.0.0, kuid ei ole veel m\u00e4\u00e4ratlenud, millal blokeering brauseris j\u00f5ustub. Chrome'is plaanitakse 0.0.0.0 juurdep\u00e4\u00e4su blokeerida Chrome'i 128 versioonis, mis on oodata j\u00e4rgmisel n\u00e4dalal. Safari plaanib 0.0.0.0 blokeeringu rakendada Safari 18 versioonis.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Oligo Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Chrome, Firefox \u0438 Safari, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0443 0.0.0.0. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0435\u0449\u0451 18 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u043d\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a \u0438 \u043d\u0435 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119441,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119440","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus veebibrauserites, mis v\u00f5imaldab r\u00fcnnata kohalikke teenuseid IP kaudu 0.0.0.0 | ProHoster","description":"Oligo Security on avaldanud teavet haavatavuse kohta, mis m\u00f5jutab Chrome'i, Firefoxi ja Safari't, mis v\u00f5imaldab \u00fcletada juurdep\u00e4\u00e4su piirangud ainult lokaalses s\u00fcsteemis k\u00e4ttesaadavatele v\u00f5rguteenustele, p\u00f6\u00f6rdudes IP-aadressi 0.0.0.0 poole. Esimesed hoiatused haavatavuse kohta avaldati juba 18 aastat tagasi, kuid probleem pole siiani lahendatud. Haavatavus avaldub ainult","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 web-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0447\u0435\u0440\u0435\u0437 IP 0.0.0.0 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Oligo Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Chrome, Firefox \u0438 Safari, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0443 0.0.0.0. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0435\u0449\u0451 18 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u043d\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a \u0438 \u043d\u0435 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-13T13:43:15+00:00","article:modified_time":"2024-08-13T13:43:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119440","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:01:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:52:19","updated":"2026-02-09 22:01:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=119440"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119440\/revisions"}],"predecessor-version":[{"id":160058,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119440\/revisions\/160058"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/119441"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=119440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=119440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=119440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}