this post was submitted on 08 Aug 2024
76 points (100.0% liked)

Technology

37720 readers
411 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago
MODERATORS
alyaza@beehaw.org
TheRtRevKaiser@beehaw.org
gyrfalcon@beehaw.org
rs5th@beehaw.org
Los@beehaw.org
coldredlight@beehaw.org
SemioticStandard@beehaw.org
TheRtRevKaiser@kbin.social
remington@beehaw.org
76
0.0.0.0 Day - 18 Yr Old Vulnerability Let Attackers Bypass All Browser Security (cybersecuritynews.com)
submitted 3 months ago by Dnb@lemmy.dbzer0.com to c/technology@beehaw.org
17 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] tyler@programming.dev 25 points 3 months ago (3 children)

The article literally doesn’t explain the vulnerability at all.

[–] floofloof@lemmy.ca 26 points 3 months ago* (last edited 3 months ago) (1 children)

It keeps promising to, then goes off into more ChatGPT-style rambling. It's a bad article. This one is more informative:

https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser

[–] Kissaki@beehaw.org 16 points 3 months ago* (last edited 3 months ago)

notably

Windows is not impacted by this issue.

quoting the main, critical part:

  1. Under public domain (.com), the browser sent the request to 0.0.0.0.
  2. The dummy server is listening on 127.0.0.1 (only on the loopback interface, not on all network interfaces).
  3. The server on localhost receives the request, processes it, and sends the response.
  4. The browser blocks the response content from propagating to Javascript due to CORS.

This means public websites can access any open port on your host, without the ability to see the response.

[–] biscuitswalrus@aussie.zone 9 points 3 months ago

I ended up reading it on bleeping computer since the linked site looks like an auto tldr bot saved 50% of the words. The important 50% was discarded.

https://www.bleepingcomputer.com/news/security/18-year-old-security-flaw-in-firefox-and-chrome-exploited-in-attacks/

[–] drwho@beehaw.org 8 points 3 months ago (1 children)

Everybody who could explain it well is at Hacker Summer Camp right now.

[–] unconfirmedsourcesDOTgov@lemmy.sdf.org 4 points 3 months ago

I didn't realize DEFCON was this weekend already, but this is a solid point 😂