5

If I have a locally running Postgres configured to trust all connections from localhost, does it mean any website I visit has the ability to make a localhost-to-localhost connection to Postgres with JavaScript running in my browser?

5
  • Seems like it. JS can connect to localhost, but CORS does not allow reading any of the data. If write-only access is possible is up in the air. Good question though.
    – user163495
    Nov 18, 2020 at 17:22
  • @MechMK1 true, but more digging would be necessary to say for sure. Unlike HTTP, sending data to a database is more complicated than just firing off some TCP packets. Due to CORS restrictions it may practically be impossible. It would also (I think) need to support an HTTP-like connection. You can get a browser to send emails through localhost because asking a mail server to send an email is close enough to an HTTP request that the browser can do it. It can't necessarily implement arbitrary TCP protocols though. Nov 18, 2020 at 17:32
  • Also, because the above attacks are possible, browsers typically refuse to communicate over some common TCP ports that are used for non-HTTP services, so your database port may be inaccessible regardless. Nov 18, 2020 at 17:32
  • @ConorMancone Oh yeah, I remember that firefox blocks TCP/3306. At least it did way back then
    – user163495
    Nov 18, 2020 at 17:33
  • I was just trying to dig up the list of blocked ports but can't find it. I first learned about it in regards to browsers blocking common SMTP ports. Seems likely they would also block database ports, but I've never personally looked into that. Nov 18, 2020 at 17:35

2 Answers 2

3

You basically rely on the strictness of the PostgreSQL protocol parser. In the past there were several attacks where too much tolerance against malformed input made attacks from the browser possible, even though the browser did not correctly speak the application protocol. See for example HTML Form Protocol Attack or more recently NAT SLIPStreaming. This made the browser block several ports for outgoing connections, but notably the default PostgreSQL port 5432 does not seem to be one of these.

While it might work in this specific case it is a bad idea on general to rely on the unknown robustness of a implementation. This is especially true if there are other options: PostgreSQL can use UNIX domain sockets. With UNIX domain sockets these are not only safe against access from the browser but also the access from other users on the system can be much easier restricted, since UNIX domain sockets will use file system permissions (i.e. user, group, ...) for access control.

2

Javascript inside a webpage can't connect to arbitrary TCP/IP port, Javascript inside browser uses limited set of protocols (HTTP, WebSocket, WebRTC). The restriction is on the browser level not the language itself; this remains true only for publicly available browsers that doesn't have extension that acts as a TCP proxy.
In another hand, if the local Postgres (or any database server) can accept sql requests over HTTP than there is a risk for malicious website to exploit this feature, which presents a vulnerability if it is not monitored.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .