1

I have seen this pattern that allows web pages to interact with local system resources through a HTTP interface and I have a couple questions about it:

  1. What is this pattern called?
  2. What recommendations exist for implementing this pattern?
  3. What are the security implications?

Basically, the requirement is to access a local resource on the users machine, such as a USB device. The pattern is as follows:

  1. The user is prompted to download an executable.
  2. The executable exposes a service on http://localhost:port.
  3. The controlling web page handles the UI/UX and communicates with the service through http.

The Bose update service is one example. Navigate to https://btu.bose.com and you are prompted to download and install the Bose updater.

Bose download prompt

The page begins polling localhost and receiving a timeout error. After installation, the connection succeeds and the page changes:

Bose ready

Here is one of the URLs and the response:

http://localhost:49312/updater/getUpdaterVersion?callback=BoseUpdater.remoteCallback&token=T187369b21bf6

BoseUpdater.remoteCallback("T187369b21bf6",{"version" : "3.0.1.1891"},0);
Improve this question
2
  • 1
    It's just an ordinary web service. Nothing special at all.
    – Robert Harvey
    Feb 17, 2018 at 19:51
  • Completely standard. Just remember to enable CORS on det localhost service.
    – Esben Skov Pedersen
    Feb 17, 2018 at 20:08

1 Answer 1

Reset to default
-1

Port forwarding is the name:

TL;DR

Port forwarding enables you to view content from your development machine's web server on your Android device.

If your web server is using a custom domain, you can set up your Android device to access the content at that domain with custom domain mapping.

In the above scenario, you are connected to http://btu.bose.com on port 80. After a connection to localhost port 49312 is established, the response is sent back to http://btu.bose.com on port 80.

To access a resource, any HTTP server can map a file or directory to a URL. In this case, the Bose installer knows the path based on the installer metadata. For example, here is how to do it in httpd:

There are frequently circumstances where it is necessary to allow web access to parts of the filesystem that are not strictly underneath the DocumentRoot. httpd offers several different ways to accomplish this. On Unix systems, symbolic links can bring other parts of the filesystem under the DocumentRoot. For security reasons, httpd will follow symbolic links only if the Options setting for the relevant directory includes FollowSymLinks or SymLinksIfOwnerMatch.

Alternatively, the Alias directive will map any part of the filesystem into the web space. For example, with

Alias "/docs" "/var/web"

the URL http://www.example.com/docs/dir/file.html will be served from /var/web/dir/file.html. The ScriptAlias directive works the same way, with the additional effect that all content located at the target path is treated as CGI scripts.

Security risks depend on the OS and its configuration:

The risk from these attacks resides in the systems in which your applications run, as opposed to the runtime itself. If an attacker manages to run malicious code on an unpatched OS, they may be able to access memory and or data that they should not have access to. We strongly recommend to update your system to use the latest fixes available for each OS.

XAMPP installers are not affected by these vulnerabilities. Only the new XAMPP VM for OS X that uses a Debian virtual machine.

References

Improve this answer
2
  • 1
    What the OP is asking about is definitely not port forwarding.
    – whatsisname
    Apr 23, 2018 at 0:34
  • Pretty much, that's not what was asked...
    – Haroldo_OK
    Aug 7, 2020 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.