News for hackers. Stuff that matters.

A comment on Direct Sockets API in Chrome 131. Parent comment

Re:Direct Sockets API in Chrome 131 by chrismorgan on Friday November 01, 2024 @10:12PM (#42023559)
> but didn’t (in my reading) address use of the API as being part of an otherwise essentially trusted app

That’s what the Narrower Applicability section is about <https://github.com/mozilla/standards-positions/issues/431#is...>. It exposes new vulnerabilities because of IP address reuse across networks, and DNS rebinding.

[ Parent | on HN ]
Re:Direct Sockets API in Chrome 131 by mmis1000 on Saturday November 02, 2024 @01:47PM (#42027900)
- It is possible, if not likely, that an attacker will control name resolution for a chosen name. This allows them to provide an IP address (or a redirect that uses CNAME or similar) that could enable request forgery.

This is quite trival, not even possible though. DNS server is quite a simple protocol. Writing a dns that reflect every request from aaa-bbb-ccc-ddd.domain.test to ip aaa.bbb.ccc.ddd won't take you even for a day. And in fact this already existed in the wild.

[ Parent | on HN ]