{"id":119440,"date":"2024-08-13T15:43:13","date_gmt":"2024-08-13T13:43:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0"},"modified":"2024-08-13T15:43:13","modified_gmt":"2024-08-13T13:43:15","slug":"uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","title":{"rendered":"Veakindel veebibrauseridest, mis v\u00f5imaldab r\u00fcnnata kohalikke teenuseid HTTP 0.0.0.0 kaudu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Oligo Security avaldas teavet haavatavuse kohta, mis m\u00f5jutab Chrome'i, Firefoxi ja Safari't, ning v\u00f5imaldab m\u00f6\u00f6da minna kohalike s\u00fcsteemide jaoks saadaval olevate v\u00f5rguteenuste juurdep\u00e4\u00e4su piirangutest, p\u00f6\u00f6rdudes IP-aadressi 0.0.0.0 kaudu. Esimesed hoiatused haavatavuse kohta avaldati juba 18 aastat tagasi, kuid probleem pole siiani lahendust leidnud. <\/p>\n

Haavatavus, mis ilmneb ainult Linuxis ja macOS-is, tuleneb sellest, et IP-aadress 0.0.0.0 toob nendel platvormidel kaasa p\u00f6\u00f6rdumise kohaliku v\u00f5rgu liidese (localhost) poole, st p\u00e4ringu saatmine 0.0.0.0-ile on sarnane p\u00e4ringule aadressile 127.0.0.1. Kaasaegsetes brauserites on olemas meetmed, et takistada p\u00f6\u00f6rdumist 127.0.0.1 poole v\u00e4liste veebisaitide kasutamisel, kuna seda v\u00f5ib kasutada kasutaja s\u00fcsteemis ainult kohalike rakendustega ligip\u00e4\u00e4setavate sise teenuste manipuleerimiseks. <\/p>\n

Haavatavus v\u00f5imaldab \u00fcletada keelu p\u00f6\u00f6rduda 127.0.0.1 poole ja korraldada r\u00fcnnakuid sise teenuste vastu, avades brauseris r\u00fcnde alla kuuluva v\u00e4lise lehe. P\u00f6\u00f6rdudes l\u00e4bi 0.0.0.0, ei suuda CORS (Cross-Origin Resource Sharing) ja PNA (Private Network Access) mehhanismid takistada sellist r\u00fcnnakut. T\u00f5detakse, et probleem ei ole nii kahjutu, nagu see tundub, ja seda kasutavad kurjategijad reaalseid r\u00fcnnakute teostamisel, mis kasutavad kriitilisi haavatavusi serveri rakendustes, millele on juurdep\u00e4\u00e4s ainult kohalikele s\u00fcsteemidele.

\"Veakindel\"Veakindel<\/center> <\/p>\n

N\u00e4iteks on 0.0.0.0 kasutamine kohalike teenuste juurdep\u00e4\u00e4suks registreeritud m\u00e4rtsis ja juulis toimunud ShadowRay ja Selenium Grid r\u00fcnnakutes, mis kasutati koodi t\u00e4itmise korraldamiseks arendajate s\u00fcsteemides. ShadowRay r\u00fcnnaku sihtm\u00e4rgiks olid arendajate s\u00fcsteemid, kes kasutasid AI raamistikku Ray. Teine r\u00fcnnak oli suunatud kriitilise haavatavuse \u00e4rakasutamisele Selenium Grid'i platvormil, mille konfiguratsioonid v\u00f5tavad vastu p\u00e4ringud ainult kohalikult hostilt. <\/p>\n

Lisaks mainitakse meetodi rakendamise v\u00f5imalust ShellTorch haavatavuse \u00e4rakasutamiseks serveris<\/a> PyTorch TorchServe'is, mida kasutatakse AI-rakenduste arendajate arvutites. Kohaliku hosti v\u00f5rguteenustele juurdep\u00e4\u00e4su v\u00f5ib samuti kasutada v\u00f5rgu portide skannimiseks kasutaja kaudseks tuvastamiseks. <\/p>\n

Firefoxi arendajad on valmis muutma Fetchi spetsifikatsiooni, keelates juurdep\u00e4\u00e4su 0.0.0.0-le, kuid pole veel m\u00e4\u00e4ranud, millal blokeerimine brauseris algab. Chrome'is plaanitakse juurdep\u00e4\u00e4su 0.0.0.0 blokeerida Chrome 128 v\u00e4ljalaskes, mis on oodatav j\u00e4rgmisel n\u00e4dalal. Safari plaanib 0.0.0.0 blokeerimist rakendada Safari 18 v\u00e4ljalaskes.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Oligo Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Chrome, Firefox \u0438 Safari, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0443 0.0.0.0. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0435\u0449\u0451 18 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u043d\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a \u0438 \u043d\u0435 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119441,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119440","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus veebibrauserites, mis v\u00f5imaldab r\u00fcnnata kohalikke teenuseid IP aadressi 0.0.0.0 kaudu | ProHoster","description":"Oligo Security avaldas teavet haavatavuse kohta, mis m\u00f5jutab Chrome'i, Firefoxi ja Safari't ning v\u00f5imaldab ringutada juurdep\u00e4\u00e4su piirangut kohalikele s\u00fcsteemidele kergesti juurdep\u00e4\u00e4setavatele v\u00f5rguteenustele.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 web-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0447\u0435\u0440\u0435\u0437 IP 0.0.0.0 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Oligo Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Chrome, Firefox \u0438 Safari, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-13T13:43:15+00:00","article:modified_time":"2024-08-13T13:43:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119440","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:01:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:52:19","updated":"2026-02-09 22:01:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=119440"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119440\/revisions"}],"predecessor-version":[{"id":160058,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119440\/revisions\/160058"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/119441"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=119440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=119440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=119440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}