0.0.0.0 Day: 18-Year-Old Browser Vulnerability Impacts MacOS and Linux Devices

DNS rebinding was indeed discussed a few years ago in uBO’s issue repo.

Btw, uBO has added ipaddress static network filter option which utilizes Firefox’ dns.resolve() and webRequest.onHeadersReceived.

Related commits:

https://github.com/gorhill/uBlock/commit/c6dedd253f
https://github.com/gorhill/uBlock/commit/030d7334e4
https://github.com/gorhill/uBlock/commit/6acf97bf51

Related filters:

https://github.com/uBlockOrigin/uAssets/blob/0b86acd1408e37f36c8b6b176f44c67c49796c0d/filters/privacy.txt#L1028
https://github.com/uBlockOrigin/uAssets/blob/0b86acd1408e37f36c8b6b176f44c67c49796c0d/filters/lan-block.txt#L107-L109
Some notes

The reason for additional webRequest.onHeadersReceived is because the IP result from extensions’ dns.resolve() (uBO, NoScript…) might be not the same as what browser would actually use at the end.

Some more reads at: Boosting Blind SSRF Attacks Using DNS Rebinding

The filters are available for Firefox and in dev build now. They could arrive when version 1.59.1+ is released.