I can see your local web servers • Hacker News Board

Re: I can see your local web servers

#91

Post by bill_joy_fanboy » Tue, May 28, 2019, 1:08 PM UTC

I'm interested in this because I don't fully understand the consequences here. I'd like to gain a deeper understanding through some concrete examples.

With the PHP CLI, I can run:

    php -S localhost:8000

With Python3, I can run:

    python -m http.server 8000 --bind localhost

The demo fails for me in both cases, even though a request to localhost:8000 is sent. (EDIT: The server log in the terminal window does show that the request arrived at the local server).

My question is: What is the risk of running one of these servers and then visiting some random web page?

Re: I can see your local web servers

#92

Post by [deleted] » Tue, May 28, 2019, 1:10 PM UTC

lostjohnny wrote: post #24

Nope, you can't Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing) Anyway TypeError: /(192\.168\.[0-9]+\.)[0-9]+/.exec(...) is null i-can-see-your-local-web-servers:169:41

[deleted]

Re: I can see your local web servers

#93

Post by Cakez0r » Tue, May 28, 2019, 1:11 PM UTC

bg0 wrote: post #88

So does this mean that if I'm running a local dev machine with un-bundled source code on my company computer: Any person that joins the wifi network and goes to a website that sniff's this out will have access to my computers local server?

Depends what server software you're running and how it's configured. The specific configuration element you want to look for is usually called the "bind address". If it's set to something other than "127.0.0.1" then it will probably accept external connections.

If you know the port number your server is running on, you can also open up command prompt / terminal and check with "netstat -an". Look at the local address column and make sure your web server is listening on 127.0.0.1.

Re: I can see your local web servers

#94

Post by rlue » Tue, May 28, 2019, 1:19 PM UTC

Can anyone explain what kinds of attacks are possible here? A malicious script on this website can identify that a service is running on a particular endpoint (IP + port), and depending on the server's CORS policy, the script may be able to submit HTTP requests to that service... am I getting it right? I can see how that might be dangerous if the service responds to simple GET requests with sensitive information, or has a well-documented REST API and no authentication. Is this the scope of the vulnerability, or is there more to it?

I tried this with a few different services running on my machine (a one-liner WEBrick server in Ruby, Syncthing, a plain-text accounting program calling beancount, etc. etc.) and the script didn't detect any. I take it that means that these services all don't allow CORS?

Re: I can see your local web servers

#95

Post by ericcholis » Tue, May 28, 2019, 1:29 PM UTC

rlue wrote: post #94

Can anyone explain what kinds of attacks are possible here? A malicious script on this website can identify that a service is running on a particular endpoint (IP + port), and depending on the server's CORS policy, the script may be able to submit HTTP requests to that service... am I getting it right? I can see how that might be dangerous if the service responds to simple GET requests with sensitive information, or…

This comes to mind recently https://securityaffairs.co/wordpress/84803/hacking/dell-supp...

Re: I can see your local web servers

#96

Post by megous » Tue, May 28, 2019, 1:32 PM UTC

MrGilbert wrote: post #86

megous wrote: post #39

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…

From my experience as a dev (who has already submitted extensions to moz), this will be sorted out. However, it might take up to 4 - 6 weeks, until an actual human being reviews the changes. But it gets reviewed.

Last updated "5 months ago (Dec 16, 2018)".

One would hope that reporting an extension would help reviewing it sooner especially if it's 26th top rated one and all that's needed is to verify the claims in the report.

Re: I can see your local web servers

#97

Post by bg0 » Tue, May 28, 2019, 1:35 PM UTC

Cakez0r wrote: post #93

bg0 wrote: post #88

So does this mean that if I'm running a local dev machine with un-bundled source code on my company computer: Any person that joins the wifi network and goes to a website that sniff's this out will have access to my computers local server?

Depends what server software you're running and how it's configured. The specific configuration element you want to look for is usually called the "bind address". If it's set to something other than "127.0.0.1" then it will probably accept external connections. If you know the port number your server is running on, you can also open up command prompt / terminal and check with "netstat -an". Look at the local address…

Appreciate the insight. Looks like I see:

tcp4 // 0 // 0 // * . 8080 // * . * // LISTEN

Local address being (*.8080)

Re: I can see your local web servers

#98

Post by tlrobinson » Tue, May 28, 2019, 1:47 PM UTC

lostjohnny wrote: post #24

Nope, you can't Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing) Anyway TypeError: /(192\.168\.[0-9]+\.)[0-9]+/.exec(...) is null i-can-see-your-local-web-servers:169:41

The post specifically mentions CORS and shows an example Express app that has CORS enabled.

Re: I can see your local web servers

#99

Post by kapep » Tue, May 28, 2019, 1:50 PM UTC

megous wrote: post #39

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…

Is there any way to get the source code of extensions from the Mozilla web site? I think some years ago you could look at the code in your browser from a link in the version history but I don't see any links at all now.

Re: I can see your local web servers

#100

Post by penagwin » Tue, May 28, 2019, 1:53 PM UTC

mehrdadn wrote: post #84

mjlee wrote: post #82

Earlier quoted context omitted.

There are a fair number of applications that expose a UI with a local web server. I use the Ubiquiti Controller, but it's also quite common in the world of Plex, etc. It's also a path used for local OIDC, such as with the gcloud CLI.

> expose a UI with a local web server I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.

While I think it would be a shame to completely disable the ability for remote sites to access localhost (I'm sure it can be useful somehow), it would make far more sense to be opt-in for those cases.

Maybe browsers should assume a CORS deny all unless otherwise specified?