0000 Day exposes MacOS and Linux vulnerability for 18-year-old browsers

TLDR:

Key Points:

• 0.0.0.0 Day vulnerability discovered impacting all major web browsers on MacOS and Linux devices.
• The vulnerability allows malicious websites to breach local networks leading to unauthorized access and remote code execution.

The critical vulnerability, known as “0.0.0.0 Day,” exposes a flaw in how browsers handle network requests, potentially allowing attackers to access sensitive services on local devices. This vulnerability affects Google Chrome/Chromium, Mozilla Firefox, and Apple Safari, enabling external websites to communicate with software running locally on MacOS and Linux. It has been around since 2006 and allows attackers to execute arbitrary code on the visitor’s host.

The vulnerability stems from a lack of standardization across different browsers and is a bypass of Private Network Access (PNA). Web browsers are expected to block access to 0.0.0.0 completely in response to these findings, deprecating direct access to private network endpoints from public websites. The use of 0.0.0.0 combined with mode ‘no-cors’ enables attackers to gain remote code execution using a single HTTP request.

This vulnerability has significant implications for browser security, network security, and remote code execution on MacOS and Linux devices. It highlights the importance of consistent security mechanisms across browsers to prevent unauthorized access to local services.