Researchers at Oligo Security have unearthed a critical vulnerability, named “0.0.0.0 Day,” which has persisted unnoticed for 18 years and affects all major web browsers, including Chromium, Firefox, and Safari.
This vulnerability allows malicious websites to circumvent browser security measures, enabling them to interact with services on an organization’s local network. This could potentially result in unauthorized access and remote code execution on local services by attackers operating from outside the network. The root of the problem lies in inconsistent security implementations across different browsers and the lack of standardized practices within the browser industry.
The issue revolves around the IP address 0.0.0.0, commonly used as a placeholder or default address. Attackers can exploit this address to access local services, including those used for development, operating systems, and internal networks.
The ramifications of the 0.0.0.0 Day vulnerability are significant, impacting both individuals and organizations. By bypassing browser security, attackers can potentially gain access to sensitive local services, leading to data breaches, unauthorized access, and remote code execution.
A bug report dating back to 2006 highlights the longstanding issue of browsers allowing requests from less-secure contexts to reach local or internal networks. Despite various discussions and reprioritizations, this bug remains unresolved.
The lack of industry-wide standardization has resulted in inconsistent browser security implementations, leading to vulnerabilities like 0.0.0.0 Day.
How 0.0.0.0 Day Bypasses Browser Security
Understanding this vulnerability requires a grasp of browser security fundamentals and the role of IP addresses like 0.0.0.0.
Browsers have always been prime targets for security threats, leading to the introduction of advanced security measures such as sandboxing and HTTPS-only cookies.
The IP address 0.0.0.0 serves multiple purposes, including functioning as a placeholder or default address. However, its use as a destination address in IPv4 is restricted, being allowed only as a source address under specific conditions.
Despite these limitations, 0.0.0.0 is used in various scenarios, such as in /etc/hosts files to block certain domains or in network policies to allow connections from all IPs.
Digitally “fingerprinting” website users is a known technique for tracking and identifying users. However, malicious actors can also use this method to gather intelligence for phishing or other attacks.
The 0.0.0.0 Day vulnerability enables attackers to port scan users, which could reveal open ports and vulnerable services.
Google’s Private Network Access (PNA) initiative aims to enhance CORS by restricting websites’ ability to send requests to private network servers. PNA introduces a distinction between public, private, and local networks, preventing less-secure contexts from sending requests to more secure ones.
Under the current PNA specification, certain IP segments are classified as private or local:
Testing 0.0.0.0 Day: Bypassing PNA
Oligo Security researchers discovered that 0.0.0.0 was not listed as a private or local IP segment, allowing websites to send requests to it.
After responsibly disclosing this issue, Oligo Security reported the PNA bypass and the underlying browser vulnerabilities to all major browser vendors.
Several applications are likely affected by the 0.0.0.0 Day vulnerability. Oligo Security identified several vulnerable applications, such as Ray, Selenium Grid, and Pytorch Torchserve (ShellTorch), that could be exploited through 0.0.0.0, leading to remote code execution and unauthorized access.
Browser vendors have acknowledged the vulnerability following its disclosure and are now working on implementing mitigations at the browser level.
Google Chrome (and Chromium-based browsers like Edge)
- PNA Initiative: Google is leading the evolution of Private Network Access (PNA).
- Vulnerability: 0.0.0.0 bypasses PNA, allowing access to private IPs.
- Fix Rollout: Blocking of 0.0.0.0 starting from Chrome 128, with full effect by Chrome 133.
- Statistics: Approximately 0.015% of websites (around 100,000) communicate with 0.0.0.0.
Apple Safari
- WebKit Changes: 0.0.0.0 access is now blocked.
- Implementation: All-zero IP addresses are blocked in requests.
Mozilla Firefox
- Current Status: No immediate fix; PNA was not initially implemented.
- Specification Update: The Fetch specification has been updated to block 0.0.0.0.
- Future Plans: PNA implementation will eventually block 0.0.0.0.
The 0.0.0.0 Day vulnerability underscores the critical need for standardization in the browser industry and the comprehensive implementation of Private Network Access (PNA) according to that standard. Until PNA is fully deployed, public websites can still send HTTP requests using JavaScript to reach services on local networks, posing risks of unauthorized access and remote code execution.
