News for hackers. Stuff that matters.

A comment on RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit. Parent comment

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by ectopod on Tuesday December 21, 2021 @09:27AM (#29637632)
No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.
[ Parent | on HN ]
Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by dboreham on Tuesday December 21, 2021 @10:21AM (#29638184)
Wait, the browser allows random http connections to localhost from JS fetched from any domain??

Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.

[ Parent | on HN ]
Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by AntonyGarand on Tuesday December 21, 2021 @12:37PM (#29639825)
It does, if the server accepts the connection there is nothing preventing it.

This is frequently used by apps which are installed on your machine but are accessed by links, such as zoom and discord. I think Zoom removed its server after receiving pressure[0] about it, but discord still does it: Head to https://discord.com/invite/test and it should open your local discord client, or checking the network requests will reveal up to 10 attempted local ports.

[0] https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

[ Parent | on HN ]
Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by nitrogen on Tuesday December 21, 2021 @12:08PM (#29639435)
Do browsers block access to 192.168/16 or 10/8 etc?
[ Parent | on HN ]