Hacker News Reader

Comment by gigel82 | Hacker News Reader

If I'm reading this right, it assumes the machine's IP is publicly accessible over the internet; which I'm guessing -even with IPv6- is not the case in 99.999% of cases; who just exposes their development machine directly to the internet with a public IP?

Still bad, but not quite as bad as owning from the browser via localhost GET.

View on HN

No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.

Wait, the browser allows random http connections to localhost from JS fetched from any domain??

Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.

Do browsers block access to 192.168/16 or 10/8 etc?

It does, if the server accepts the connection there is nothing preventing it.

This is frequently used by apps which are installed on your machine but are accessed by links, such as zoom and discord. I think Zoom removed its server after receiving pressure[0] about it, but discord still does it: Head to https://discord.com/invite/test and it should open your local discord client, or checking the network requests will reveal up to 10 attempted local ports.

[0] https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

This guess would be incorrect both in the percentage, and in the assumption that this would be required for exploitability.

Reply on news.ycombinator.com