0.0.0.0 Day: Vulnerability Affecting MacOS and Linux Devices Discovered by 18-Year-Old
A modern “0.0.0.0 Day” has recently been found affecting prominent web browsers, which can be exploited by malevolent websites to infiltrate local networks.
As per Oligo Security researcher Avi Lumelsky, this significant flaw “lays bare a fundamental weakness in how browsers manage network requests, potentially granting unauthorized entry to crucial services operating on local devices.”
The Israeli firm specializing in application security pointed out that the consequences of this vulnerability are extensive, resulting from the uneven application of security protocols and the absence of uniformity among various browsers.
This seemingly harmless IP address, 0.0.0.0, can be weaponized to exploit local services, opening the door to unauthorized entry and remote code execution by external attackers. This vulnerability has persisted since 2006.
The 0.0.0.0 Day affects Google Chrome/Chromium, Mozilla Firefox, and Apple Safari, enabling external websites to interact with local software on MacOS and Linux. Windows devices are unaffected, as Microsoft blocks this IP address at the operating system level.
Specifically, Oligo Security uncovered that public websites with domain names ending in “.com” can communicate with services running on the local network and run arbitrary code on the visitor’s system by leveraging the 0.0.0.0 address instead of localhost/127.0.0.1.
This vulnerability serves as a circumvention of Private Network Access (PNA), which aims to prevent direct access from public websites to endpoints within private networks.
Any application hosted on localhost that is accessible via 0.0.0.0 is prone to remote code execution, including local Selenium Grid instances that can be exploited by dispatching a POST request to 0.0.0[.]0:4444 with a tailored payload.
In light of the discovery in April 2024, web browsers are poised to prohibit access to 0.0.0.0 entirely, thereby discontinuing direct access from public websites to private network endpoints.
“When services make use of localhost, they presume a restricted environment,” Lumelsky noted. “This presumption, which, as evidenced by this vulnerability, can be erroneous, leads to insecure server configurations.”
“By combining 0.0.0.0 with the ‘no-cors’ mode, attackers can leverage public domains to target services running on localhost and even achieve arbitrary code execution (RCE) with just a single HTTP request.”
About Author
