3 ms·
> Chrome's PNA protection can be bypassed using the IP address 0.0.0.0 to access services listening on the localhost on macOS and Linux. It seems they're sayin
by diggan 2y ago
> Chrome's PNA protection can be bypassed using the IP address 0.0.0.0 to access services listening on the localhost on macOS and Linux.
It seems they're saying if you have a service listening to localhost (private), Chrome is supposed to not resolve 0.0.0.0 (public) to localhost, yet it currently does so.
So seems to me they're solving a security bug. But if I got this right, it's surprising how it got like that in the first place, doesn't make sense in any scenario I can think of to resolve 0.0.0.0 to localhost? Why would a browser try to resolve 0.0.0.0 to anything in the first place?
- otabdeveloper4 2y ago[flagged]
- Titan2189 2y agoWait, so you're suggesting developers shouldn't adhere to specs but instead develop their tools / libraries according to whatever they feel it is the cool kids currently do?
- rolph 2y agoi fail to see much difference with: >>develop their tools / libraries according to whatever they feel it is the cool kids currently do?<< versus: >>adhere to the letter of the spec maliciously instead of understanding current practice.<<
- otabdeveloper4 2y agoYes, I do. You should be following de-facto real world standards, not fantasy ones. Especially if security is involved.
- robertlagrant 2y agoIf there are de facto real world standards, why not write them down?
- otabdeveloper4 2y agoAsk the guys writing the RFC's, not me. Boggles my mind too.
- datanut 2y agoHave you considered replacing/creating/updating RFCs/BCPs relevant to your field?
- kevindamm 2y agoRFC 3330 says you can use it as a source address for "this" host on "this" network, and that 0.0.0.0/8 can be used for other addresses on "this" network. https://www.rfc-editor.org/rfc/rfc3330 https://www.rfc-editor.org/rfc/rfc3330
- diggan 2y agoInteresting. I'd use 192.168.0.0/16 or 10.0.0.0/8 for that, and haven't found a reason yet not to. Using "0.0.0.0" for anything signals something like "I'm not sure what I want to bind it to, just bind to everything available", at least to me.
- marcosdumay 2y agoIt's not a valid machine address. It's a shortcut that, for example, if you are in the 10.0.0.0/8 network, you can use 0.0.0.1 to refer to 10.0.0.1.
- BenjiWiebe 2y agoHow come this doesn't work on my Fedora Linux PC? If I try to ping 0.0.0.1 it just tries to ping 0.0.0.1 which doesn't respond as it doesn't exist.
- emptiestplace 2y agoAre you /8?
- BenjiWiebe 2y agoNope, /24.
- binwiederhier 2y agoWell, this was a surprise to me too, but apparently Linux does this: $ ping 0.0.0.0 PING 0.0.0.0 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.028 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.056 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.105 ms ... $ nc 0.0.0.0 22 SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10 ...
- focusedone 2y agoping 0 works too. Kinda fun.
- mh0pe 2y agoFun fact, ping 0 works because 0 is the IP decimal notation of 0.0.0.0. One of my favorite age-old WAF bypass since it doesn't match octet notation regexes that are often in place.
- icedchai 2y agoThis behavior has existed since at least the 1990s on various platforms. Pretty sure I first saw it in SunOS.