3 ms·

If I'm reading this right, it assumes the machine's IP is publicly accessible over the internet; which I'm guessing -even with IPv6- is not the case in 99.999%

If I'm reading this right, it assumes the machine's IP is publicly accessible over the internet; which I'm guessing -even with IPv6- is not the case in 99.999% of cases; who just exposes their development machine directly to the internet with a public IP? Still bad, but not quite as bad as owning from the browser via localhost GET.

fulafel 5y ago
This guess would be incorrect both in the percentage, and in the assumption that this would be required for exploitability.
deleted 5y ago
[deleted]
ectopod 5y ago
No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.
- dboreham 5y ago
  Wait, the browser allows random http connections to localhost from JS fetched from any domain?? Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.
  - nitrogen 5y ago
    Do browsers block access to 192.168/16 or 10/8 etc?
  - AntonyGarand 5y ago
    It does, if the server accepts the connection there is nothing preventing it. This is frequently used by apps which are installed on your machine but are accessed by links, such as zoom and discord. I think Zoom removed its server after receiving pressure[0] about it, but discord still does it: Head to https://discord.com/invite/test https://discord.com/invite/test and it should open your local discord client, or checking the network requests will reveal up to 10 attempted local ports. [0] https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...