Why do browsers allow JavaScript of external web pages to connect to localhost?

Question

I am reading http://blog.saynotolinux.com/blog/2016/08/15/jetbrains-ide-remote-code-execution-and-local-file-disclosure-vulnerability-analysis/

In that article a (now patched) vulnerability is described, in which a desktop program listens to HTTP requests from localhost. That server essentially trusts its input and it can be used to compromise the system.

All that is needed is a malicious web page with JavaScript that opens a HTTP POST to 127.0.0.1:63342 with some data.

So, why do browsers allow JavaScript of remote pages to connect to localhost? Local web servers are used for a lot of things (test servers, Jupyter noteboos etc.).

EDIT: When I was playing around, I got this error (No 'Access-Control-Allow-Origin' header is present on the requested resource). It looks like this should have prevented the attack in the blog post as well?

Answer 1

Well, localhost itself is just a hostname, other hostnames could be used similarly be setting up an A record for 127.0.0.1. The real potential problem is that browsers can be manipulated to load content from the local network, like 127.0.0.1 (localhost), 192.168.1.1 (routers), etc.

Browsers do have a feature in place to globally limit such access across hosts, called Same-Origin Policy, however CSRF attacks against poorly designed systems are still possible.

Assuming the application developers are competent enough to not blindly assume data being sent is safe, and validate it properly, they should be fine. The real problem is developers failing to understand such basic web security are all too common. For this reason we have recently seen a surge in attacks against people's routers, where CSRF attacks can reconfigure the router without any user interaction, because it blindly assumes any local traffic is safe.

---

As for out-right blocking local network requests from non-local pages in the browser, I'm not aware of any browsers presently doing this, but it is something NoScript's ABE feature does by default. I've never noticed any real downsides to using it, so I can't really speculate on why browsers do not already do this.

Answer 2

And servers connected to the internet control online banking, medical records and nuclear reactors (OK, just kidding abut the last one *)

Localhost is just another hostname.

If you're that concerned about it, and have the ability to be running servers on localhost then you should know how to isolate the traffic.

*) but who knows...?