Collected research

Common localhost dns misconfiguration can lead to "same site" scripting

Bugtraq: common dns misconfiguration can lead to "same site" scripting

Tavis Ormandy · seclists.org

Dropping the trailing dot from a 'localhost IN A 127.0.0.1' zone record makes localhost.example.com resolve to loopback, so anything listening on a shared machine receives that domain's cookies. Ormandy names it Same-Site Scripting, gives a CUPS javascript: job_printer_uri click-exploit, and lists microsoft.com, ebay.com, yahoo.com and fbi.gov as affected.

Record

Document

Bugtraq: common dns misconfiguration can lead to "same site" scripting

Researcher

Tavis Ormandy

Published by

seclists.org

Topic

Other

In the archive

• Collected in the 2008 research round

Tags

• dns
• cookie
• xss
• same-origin-policy
• info-leak
• mitigation
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Tavis Ormandy, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.