Description

Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-25T11:17:16.470Z",
  "pubdate": "2026-09-25T11:17:16.470Z",
  "executiveSummary": "Rojo's 'rojo serve' HTTP API is susceptible to DNS rebinding attacks due to a critical lack of Host and Origin header validation. By failing to verify the source of incoming requests, the Rojo server accepts commands from unauthorized web origins.\nThe vulnerability allows an attacker to gain full control over the local development environment. By enticing a user to visit a malicious webpage, an attacker can bypass browser-based same-origin policy protections to interact with the Rojo API.\nThe impact is severe, enabling unauthorized access to project source code, arbitrary file writes, and the execution of local programs via the 'opener::open()' function. This exposes the user to remote code execution (RCE) scenarios and full project compromise.\nThis vulnerability affects the Rojo tool when the 'rojo serve' service is active on the default port 34872. There is no authentication required for these API calls, meaning any malicious site can act as a client if the user is currently running the Rojo server locally.",
  "technicalDetails": "The root cause of this vulnerability is the absence of request origin verification within the Rojo 'rojo serve' HTTP API. Standard web security protocols rely on the server to validate the 'Host' or 'Origin' headers to prevent cross-site request forgery and rebinding attacks. Because the Rojo API processes incoming requests without these checks, it assumes that any request received on the local socket is legitimate.\nThe attack flow leverages a DNS rebinding technique. Initially, the attacker hosts a malicious website that resolves to a domain controlled by the attacker. When the victim visits the site, the attacker's script initiates a connection to the victim's local 'rojo serve' instance on port 34872. By manipulating the DNS TTL (Time to Live) values, the attacker rebinds the malicious domain from the attacker's server IP to '127.0.0.1'.\nOnce the domain resolves to the local loopback address, the browser's same-origin policy (SOP) considers requests to the Rojo API to be 'same-origin' with the malicious webpage. Consequently, the browser facilitates the delivery of arbitrary requests to the API. Since the Rojo API does not perform secondary validation (such as checking authentication tokens or verifying origin headers), the server executes the commands contained within the request payload.\nAn attacker can exploit this to perform three high-impact actions: 1) Full project exfiltration: Reading sensitive source code files managed by the project. 2) Arbitrary file modification: Writing malicious code directly into the source tree, which can later be compiled or executed by the development environment. 3) Remote Code Execution: Invoking 'opener::open()' allows the attacker to launch local applications or trigger system-level commands, effectively extending the impact of the browser-based vulnerability to the host operating system.\nThe exploit is highly effective because it requires no specific authentication or elevated privileges beyond the user simply running the Rojo server. The network exposure is limited to the local machine, but the interaction with a malicious browser session creates a bridge between the web-based attack vector and the local filesystem, rendering any project currently being served by Rojo at risk of total compromise."
}