Remote Code Execution in Paperclip via DNS Rebinding

Executive Summary

CVE-2026-77087 is a critical vulnerability in Paperclip versions before 0.3.1 that allows remote code execution via DNS rebinding. The issue occurs in the default local_trusted mode where host header validation is missing. Attackers can trick a local developer into visiting a malicious webpage, which then uses DNS rebinding to bypass authentication and execute arbitrary commands through the Paperclip API.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Paperclip is running in default local_trusted mode without host header validation. Inspect network traffic for DNS rebinding attempts or unauthorized API requests to localhost. Commands like netstat -tuln or ss -tuln can show listening ports, while curl -v http://localhost:PORT may reveal missing host header restrictions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary commands on your machine as the Paperclip server's OS user. This could allow them to read or write files, install backdoors, steal sensitive data, or perform other malicious actions without your knowledge. The attack requires tricking you into visiting a malicious webpage while running a vulnerable Paperclip instance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information. The ability to execute arbitrary commands and access files may result in data breaches, unauthorized disclosures, or integrity violations, all of which are compliance concerns under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Paperclip to version 0.3.1 or later. If upgrading is not possible, disable local_trusted mode and enable host header validation by restricting allowed hostnames to localhost, 127.0.0.1, and [::1]. Block external access to Paperclip ports and monitor for suspicious DNS rebinding activity.

Useful 0 Not Useful 0