Finding new attack vector for Node.JS debugger protocol

**[March 2018 Security Releases](https://nodejs.org/en/blog/vulnerability/march-2018-security-releases) :**
> Node.js Inspector DNS rebinding vulnerability (**[CVE-2018-7160](https://nvd.nist.gov/vuln/detail/CVE-2018-7160)**)
> Node.js 6.x and later include a debugger protocol (also known as "inspector") that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.
>
> The attack was possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
>
> We updated the inspector implementation with an additional check for the browser provided Host header. If the connection is via a hostname, i.e. subject to DNS resolution, we ensure that the connection is to either localhost or localhost6 precisely.

The issue describes a historical Node.js inspector DNS rebinding vulnerability (CVE-2018-7160). Research involves understanding the Node.js debugger protocol, the specific patch that added a Host header check, and exploring potential new bypasses or attack vectors. Start by reading the Node.js security release notes and the inspector source code. The goal is to find a novel security flaw in the current debugger protocol implementation.

Rédigé par le modèle d'indexation à partir du texte de l'issue.