0.0.0.0 Day impacts Google Chrome/Chromium, Mozilla Firefox, and Apple Safari
Date of Publish :12-Aug-24
Severity: Zero Day
Affected system:
Chromium, Firefox, and Safari
Non Affected system
Windows
Summary:
This vulnerability research by Oligo Security’s researcher Avi Lumelsky, this vulnerability impacts systems running macOS and Linux system and could lead to on a compromised system, allowing them to potentilly destroy data or take control of computers for malicious purposes.
Details:
an unidentified flaw in how browsers process requests to the 0.0.0.0 IP address – a special address used to indicate all network interfaces and accessible through common browser mechanisms, leading to the exploitation of local network services.
To exploit this vulnerability via the browser, a locally running HTTP server on a localhost port is required. An attacker could exploit services that have HTTP routes capable of modifying files or configurations, as many real-world applications make such security trade-offs, presenting an opportunity for exploitation.
Recommendation:
- Implement PNA headers to ensure your applications are prepared for PNA enforcement.
- Validate the HOST header in requests to guard against DNS rebinding attacks targeting localhost or 127.0.0.1.
- Don’t rely solely on the localhost environment for security—introduce at least basic authorization, even for local apps.
- Use HTTPS wherever possible to encrypt communications.
- Incorporate CSRF tokens into your applications, even for local environments, to prevent cross-site request forgery.
- Remember that browsers can act as gateways, with routing capabilities to internal IP addresses in many cases, making it essential to secure any exposed services.
NOTE : The information is provide is on “as is “ basis, without assurance of any kind .
Revision history
1. 12-Aug-24 – advisory published. —update -update version available
About The Author
