Are MITM attacks possible on HTTP loopbacks?

Question

I have a web server running at example.com. The web server performs a server-side request to example.com which results in a loopback, so the request never passes over the network.

Is this request susceptible to a MITM attack? If so, how?

Answer 1

The problem is all in accessing the server and gaining a suitable privilege level.

update: and of course if you have such an access, you can probably take control directly of either the "server" or the "client", or both, or covertly access their same data unbeknownst to them. No need of a man in the middle if you're the man inside.

But say you have root there... then, yes, you can mount a MitM attack even if you can't use anything but the loopback interface for whatever reason, and cannot otherwise interfere with client's or server's operation.

All you need is lovecalhost duplicating its address to something useable, and telling the victim that example.com maps to that address.

Practical example using a service I have listening on localhost port 631 - cupsd. A webserver would listen on port 80, but everything else stays the same.

netstat -napo | grep LISTEN | grep -F 127.0.0.1
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1321/cupsd          off (0.00/0/0)
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      1721/named          off (0.00/0/0)
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      1721/named          off (0.00/0/0)

Now I cannot listen straight away on the chosen port since there's a legitimate process already there:

# netcat -l 127.0.0.1 631 &
[1] 26264
netcat: Address already in use
[1]+  Exit 1                  netcat -l 127.0.0.1 631
#

But nothing stops me from creating another loopback interface (lo:0 instead of lo) using aliasing...

# ifconfig lo:0 127.0.0.42
# ifconfig lo:0
lo:0      Link encap:Local Loopback
          inet addr:127.0.0.42  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1

and telling the system that example.com is indeed 127.0.0.42 by manipulating the hosts file (if the DNS had priority, I'd tweak its zone file)...

...and now I can listen (in this case to a single line)

# netcat -l 127.0.0.42 631 &
[1] 26442

and if I send that line, my listening netcat receives (and could reply):

# echo "Hello" | netcat 127.0.0.42 631
Hello
[1]+  Done                    netcat -l 127.0.0.42 631
#

Nothing has traveled outside the loopback interface (except that of course how am I inside that box if it has only a loopback interface?), and if the connection goes to "example.com", the server has no way of knowing the connection is being hijacked.

I could try and do this even without aliasing, but the required procedure would heavily disrupt communications and might not work always, or even at all, since I cannot easily prevent client and server from hearing one another.

(The aliasing I did here is just a proof of concept, and would probably cause havoc down the line - just consider I have now 127.0.0.1 and 127.0.0.42 on the same "trunk" and they both have /8 masking)

Answer 2

Assuming example.com actually resolves back to the server, and not to a load-balancer, SSL terminator, or other piece of hardware, then no, there's no MITM as there's nothing to be in the middle of. If you can, using localhost may be a better option to make sure the request always stays local, but that may not be possible if name-based vhosts are in use.