Attacking The Developer Environment Through Drive-by Localhost Attacks#

Joseph Beeton

• Why: Punctures the "bound to loopback = invisible" assumption that underpins how developers run services — relevant to anyone whose engineers run K8s dashboards, dev servers, and tooling locally.
• What: JavaScript from any visited website can reach services bound to localhost via non-preflighted HTTP requests; abusing common Spring/Quarkus misconfigurations or newly found vulnerabilities yields RCE on developer machines (Quarkus, older Spring) and exfiltration of AI training models from MLflow. (from abstract only)
• How: Compromise a site developers use (or inject JS via ads / phishing to open a page), then cross-origin-request the localhost service; the talk details the browser mechanics, limitations, and what browser vendors are changing to close the class.
• Where applicable: Any machine running less-securely-configured local services, especially Java frameworks and MLflow; time-limited — browser vendors are closing this class, but it is live today.