0.0.0.0 Day: Exploiting Localhost APIs From The Browser
summary
Research shows 0.0.0.0 bypass lets browser requests reach localhost services despite Private Network Access, enabling port discovery and HTTP RCE. A WASM port scanner maps open ports and a proof‑of‑concept POST to Ray’s dashboard on port 8265 triggers jobs and spawns reverse shells. Testing finds thousands of exposed Ray clusters, active crypto miners and 62 OpenAI tokens leaked; Apple patches at WebKit level, Microsoft blocks at OS level, Chromium prototypes fixes then rolls back.
AI-written summary · about
chapters (18)
- 0:00Introduction to 0.0.0.0 Day
- 1:03Client port scanning and PNA
- 3:13Private vs public networks
- 4:17History of localhost security issues
- 7:50Private Network Access initiative
- 10:37The 0.0.0.0 address explained
- 13:47Why 0.0.0.0 bypasses PNA
- 15:12Building a port scanner
- 16:57Shadow Ray attack campaign
- 20:33Ray’s default 0.0.0.0 binding
- 23:05Attackers exploiting Ray clusters
- 25:32Attacking private apps via browser
- 26:59Demonstrating the exploit
- 29:33Full attack flow walkthrough
- 31:21Browser vendor responses
- 34:31Future of PNA and fixes
- 35:57Recommendations and call to action
- 37:48Q&A and closing
related talks
58mWhere did you find that?
01h 04mServer-Side Browsing Considered Harmful
54mWhere did you find that?
40mHow to hack an Angular app?
40mAll Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.
41mLive Hacking: Breaking into Your Web App
59mIf You Can't Open It, You Don't Own It
26mInternet Scanning - Current State and Lessons Learned