> One would have to be on the same lan to exploit it.
For what it's worth, DNS rebinding attacks are commonly used against embedded devices, and remove this restriction.
For what it's worth, DNS rebinding attacks are commonly used against embedded devices, and remove this restriction.
This should be a huge scandal. For some reason we tend to give browsers a free pass when it comes to security.
E.g. you have a build server and chose to use live DNS to point at it artifacts on an internal network because it was simpler to just edit a single zone file.
Plus, it just breaks things. More than once have I had the problem of trying to serve files to other devices on a LAN I was visiting, only for their idiotic local resolver to helpfully refuse resolving the host name of my laptop because, oh surprise, it resolved to an address on that LAN!