0.0.0.0 Day: Exploiting Localhost APIs from the Browser
Unveils the 0.0.0.0-day vulnerability in major browsers that lets public websites pivot to internal localhost APIs and achieve RCE.
Summary
The 0.0.0.0-Day Vulnerability
While browsers enforce same-origin policies to isolate web origins, a systemic flaw in major browsers allowed public internet websites to send requests to IP address 0.0.0.0, bypassing standard localhost restrictions.
Attacking Internal Developer Services
By sending HTTP requests to local ports via 0.0.0.0, malicious web pages can interact directly with unauthenticated services and developer tools running on a developer's workstation behind corporate firewalls.
Remote Code Execution Demonstration
A live attack demonstration showcases how the 0.0.0.0-day enables remote code execution against popular data engineering and AI development frameworks by exploiting unauthenticated local management APIs.
Related talks
App Sec Village·37 min
Parsia Hakimian
Explores browser sandbox architecture and demonstrates localghost techniques for escaping client-side sandboxes.
Main Stage·35 min
Ji'an Zhou · Lishuo Song
Discloses multiple memory corruption and deserialization vulnerabilities in PyTorch's TorchScript JIT engine that allow arbitrary remote code execution via malicious AI models.
Main Stage·34 min
Ji'an Zhou · Ying Zhu · ZiYang Li
Reveals critical architectural and deserialization vulnerabilities across Apache Kafka client and server implementations, enabling remote code execution.