Paperclip (< 0.3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/paperclip--0.3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 21 Aug 2026 15:25:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in Paperclip via DNS Rebindinghttps://feed.craftedsignal.io/briefs/2026-08-paperclip-dns-rebinding/Fri, 21 Aug 2026 15:25:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-paperclip-dns-rebinding/Paperclip versions prior to 0.3.1 are vulnerable to remote code execution due to improper Host header validation when running in 'local_trusted' mode, allowing attackers to leverage DNS rebinding to execute arbitrary commands.Paperclip versions before 0.3.1 contain a critical security vulnerability (CVE-2026-77087) affecting users who run the software in its default 'local_trusted' mode. The vulnerability stems from a failure to validate the Host header during incoming API requests. An attacker can exploit this via DNS rebinding; by tricking a developer into visiting a malicious webpage, the attacker can force the victim's browser to make unauthorized, authenticated API requests to the locally running Paperclip instance. These requests interact with the process adapter, ultimately resulting in remote code execution on the developer's machine. This is a significant risk for development environments where Paperclip is configured to trust local traffic without strict origin verification.

Attack Chain

  1. The attacker hosts a malicious website configured to perform DNS rebinding against a target domain that resolves to 127.0.0.1.
  2. A developer or user running Paperclip locally navigates to the malicious website in their browser.
  3. The website's scripts initiate a DNS rebinding attack, causing the browser to resolve the attacker-controlled domain to a local address (e.g., localhost).
  4. The browser sends a cross-origin HTTP request to the Paperclip API running on the local host.
  5. The Paperclip application, running in 'local_trusted' mode, fails to perform Host header validation and accepts the forged request.
  6. The request triggers the Paperclip process adapter, which interprets the API command as a legitimate instruction.
  7. The process adapter executes the attacker-supplied command on the developer's local operating system with the privileges of the Paperclip process.

Impact

Successful exploitation allows an unauthenticated, remote attacker to execute arbitrary commands on a developer's workstation. This can lead to full system compromise, source code theft, credential exfiltration, and lateral movement into the developer's internal network. Given the CVSS score of 9.6, this vulnerability poses a severe threat to organizations using the affected versions of Paperclip in development environments.

Recommendation

Prioritized actions for security teams:

  • Update the Paperclip package to version 0.3.1 or higher across all development environments immediately to address CVE-2026-77087.
  • Audit development workstations to identify any active instances of Paperclip running in 'local_trusted' mode.
  • Implement browser-based protections or host-level firewall rules to prevent cross-origin requests from reaching local services on development machines.
  • Review documentation for Paperclip configurations to ensure that 'local_trusted' mode is restricted to secure network segments if it cannot be disabled.
]]>criticaladvisoryrcedns-rebindingdeveloper-toolsweb-vulnerability