[tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default

[Olivier Cornu]

Le 21/01/2014 05:06, TT Security a écrit :
> 
>> I don't think browsers in general allow connections on loopback
>> interfaces, unless explicitly requested by users.
> 
> I have Tor Browser Bundle 3.5 and Firefox 24.2.0 from there. Just open
> some port on your computer(only for testing) for example local
> web-server and try with Firefox from Tor Browser Bundle this page: 
> http://tortestprivacy.url.ph/ You will see :)

Fwiw, I can confirm this unfortunate behavior. :(
TBB connecting to loopback netcat socket from tortestprivacy.url.ph
javascript:

$ nc -l -p 1234
GET / HTTP/1.1
Host: 127.0.0.1:1234
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0)
Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://tortestprivacy.url.ph/
Origin: http://tortestprivacy.url.ph
Connection: keep-alive

--
Olivier Cornu