Rojo
Monthly
DNS rebinding against Rojo's unauthenticated 'rojo serve' HTTP API (default bind localhost, port 34872) allows a malicious webpage to read every file in the served project, write attacker-controlled code to disk, and trigger execution of local programs through the opener::open() handler. The issue affects pre-patch builds of the rojo-rbx/rojo crate and is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High), but requires the developer to be running 'rojo serve' at the moment they visit an attacker-controlled page and requires the attacker to control DNS for the rebinding; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. Impact is high for both confidentiality and integrity (full project source disclosure and arbitrary file writes) with no availability impact; exploitation is bounded to machines actively running the dev server.
DNS rebinding against Rojo's unauthenticated 'rojo serve' HTTP API (default bind localhost, port 34872) allows a malicious webpage to read every file in the served project, write attacker-controlled code to disk, and trigger execution of local programs through the opener::open() handler. The issue affects pre-patch builds of the rojo-rbx/rojo crate and is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High), but requires the developer to be running 'rojo serve' at the moment they visit an attacker-controlled page and requires the attacker to control DNS for the rebinding; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. Impact is high for both confidentiality and integrity (full project source disclosure and arbitrary file writes) with no availability impact; exploitation is bounded to machines actively running the dev server.