0.0.0.0 Day: Exploiting Localhost APIs from the Browser

This is not a zero day. The 0.0.0.0 bypass has been documented for a while now[1], including PNA bypass[2].

[1] https://github.com/nccgroup/singularity/wiki/Protection-Bypa...

[2] https://research.nccgroup.com/2023/04/27/state-of-dns-rebind...

As someone who runs nginx locally for web development, this is scary. One mitigation I can think of is to use this config for you Mac's local nginx:

  server {
    listen       80  default_server;
    server_name  _; # some invalid name that won't match anything
    return       444;
  }

And do the same thing for server_name localhost. For actual apps you are building, use a server_name like myapp.local rather than localhost. (edit: formatting)

The post includes some good remediation advice for application developers at the end.

As a user, an already available mitigation step is using uBlock Origin and enabling the prebundled "Block Outsider Intrusion into LAN" list. It's been an option for years and protects against this very vector (including 0.0.0.0).

That should give you an idea of how novel this finding is, BTW.

Text reads like AI generated logorrhea