0

I am reading http://blog.saynotolinux.com/blog/2016/08/15/jetbrains-ide-remote-code-execution-and-local-file-disclosure-vulnerability-analysis/

In that article a (now patched) vulnerability is described, in which a desktop program listens to HTTP requests from localhost. That server essentially trusts its input and it can be used to compromise the system.

All that is needed is a malicious web page with JavaScript that opens a HTTP POST to 127.0.0.1:63342 with some data.

So, why do browsers allow JavaScript of remote pages to connect to localhost? Local web servers are used for a lot of things (test servers, Jupyter noteboos etc.).

EDIT: When I was playing around, I got this error (No 'Access-Control-Allow-Origin' header is present on the requested resource). It looks like this should have prevented the attack in the blog post as well?

4

Well, localhost itself is just a hostname, other hostnames could be used similarly be setting up an A record for 127.0.0.1. The real potential problem is that browsers can be manipulated to load content from the local network, like 127.0.0.1 (localhost), 192.168.1.1 (routers), etc.

Browsers do have a feature in place to globally limit such access across hosts, called Same-Origin Policy, however CSRF attacks against poorly designed systems are still possible.

Assuming the application developers are competent enough to not blindly assume data being sent is safe, and validate it properly, they should be fine. The real problem is developers failing to understand such basic web security are all too common. For this reason we have recently seen a surge in attacks against people's routers, where CSRF attacks can reconfigure the router without any user interaction, because it blindly assumes any local traffic is safe.


As for out-right blocking local network requests from non-local pages in the browser, I'm not aware of any browsers presently doing this, but it is something NoScript's ABE feature does by default. I've never noticed any real downsides to using it, so I can't really speculate on why browsers do not already do this.

  • Thanks. I agree with you that "The real potential problem is that browsers can be manipulated to load content from the local network". I also do not see an obvious big downside to preventing this. – Ben Aug 15 '16 at 21:13
0

And servers connected to the internet control online banking, medical records and nuclear reactors (OK, just kidding abut the last one *)

Localhost is just another hostname.

If you're that concerned about it, and have the ability to be running servers on localhost then you should know how to isolate the traffic.

*) but who knows...?

  • It seems like a good thing to forbid. Lots of programs start internal servers that only listens for local connections. – Ben Aug 15 '16 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.