6 ms·

I think any browser will allow it but not allow data read back.

by brians 6mo ago

mememememememo 6mo ago
Isn't there a CORS preflight check for this? In most cases. I guess you could fashion an OG form to post form fields. But openai is probably a JSON body only. The default scenario should be secure. If the local site sends permissive CORS headers bets may be off. I would need to check but https->http may be a blocker too even in that case. Unless the attack site is http.
airza 6mo ago
There is a CORS preflight check for POST requests that don't use form-encoding. It would be somewhat surprising if these weren't using JSON (though it wouldn't be that surprising if they were parsing submitted JSON instead of actually checking the MIME-type which would probably be bad anwyay)
btown 6mo ago
FWIW this was the status quo (webpage could ping arbitrary ports but not read data, even with CORS protections) - but it is changing. This is partially in response to https://localmess.github.io/ https://localmess.github.io/ where Meta and Yandex pixel JS in websites would ping a localhost server run by their Android apps as a workaround to third-party cookie limits. Chrome 142 launched a permission dialog: https://developer.chrome.com/blog/local-network-access https://developer.chrome.com/blog/local-network-access Edge 140 followed suit: https://support.microsoft.com/en-us/topic/control-a-website-s-access-to-the-local-network-in-microsoft-edge-ef7eff4c-676d-4105-935c-2acbcd841d51 https://support.microsoft.com/en-us/topic/control-a-website-... And Firefox is in progress as well, though I couldn't find a clear announcement about rollout status: https://fosdem.org/2026/schedule/event/QCSKWL-firefox-local-network-access/ https://fosdem.org/2026/schedule/event/QCSKWL-firefox-local-... So things are getting better! But there was a scarily long time where a rogue JS script could try to blindly poke at localhost servers with crafty payloads, hoping to find a common vulnerability and gain RCE or trigger exfiltration of data via other channels. I wouldn't be surprised if this had been used in the wild.

I think any browser will allow it but not allow data read back.

by brians 6mo ago

I think any browser will allow it but not allow data read back.

Isn't there a CORS preflight check for this? In most cases. I guess you could fashion an OG form to post form fields. But openai is probably a JSON body only. The default scenario should be secure. If the local site sends permissive CORS headers bets may be off. I would need to check but https->http may be a blocker too even in that case. Unless the attack site is http.

airza 6mo ago

There is a CORS preflight check for POST requests that don't use form-encoding. It would be somewhat surprising if these weren't using JSON (though it wouldn't be that surprising if they were parsing submitted JSON instead of actually checking the MIME-type which would probably be bad anwyay)

btown 6mo ago

FWIW this was the status quo (webpage could ping arbitrary ports but not read data, even with CORS protections) - but it is changing. This is partially in response to https://localmess.github.io/ https://localmess.github.io/ where Meta and Yandex pixel JS in websites would ping a localhost server run by their Android apps as a workaround to third-party cookie limits. Chrome 142 launched a permission dialog: https://developer.chrome.com/blog/local-network-access https://developer.chrome.com/blog/local-network-access Edge 140 followed suit: https://support.microsoft.com/en-us/topic/control-a-website-s-access-to-the-local-network-in-microsoft-edge-ef7eff4c-676d-4105-935c-2acbcd841d51 https://support.microsoft.com/en-us/topic/control-a-website-... And Firefox is in progress as well, though I couldn't find a clear announcement about rollout status: https://fosdem.org/2026/schedule/event/QCSKWL-firefox-local-network-access/ https://fosdem.org/2026/schedule/event/QCSKWL-firefox-local-... So things are getting better! But there was a scarily long time where a rogue JS script could try to blindly poke at localhost servers with crafty payloads, hoping to find a common vulnerability and gain RCE or trigger exfiltration of data via other channels. I wouldn't be surprised if this had been used in the wild.