- Reported
-
- Issued
-
- Package
-
rojo
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#dns-rebinding
#cross-origin
#localhost
#code-injection
- References
-
- CVSS Score
- 8.1
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Unchanged
- Confidentiality Impact
- High
- Integrity Impact
- High
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Patched
-
Description
Rojo's rojo serve command starts an unauthenticated HTTP API on localhost
(default port 34872) with no Host or Origin header validation. While
direct cross-origin fetch() requests from a malicious website are blocked by
the browser's default CORS policy, an attacker can use DNS rebinding to bypass
this restriction entirely.
The serve API is a two-way sync protocol. Once a DNS rebind is established, a
malicious webpage visited by a developer running rojo serve can, without any
further user interaction:
- Read the full project source:
GET /api/rojo returns the session ID,
root instance ID, and project name. GET /api/read/{id} enumerates the
complete instance tree including all script contents, exposing proprietary
game logic, configuration, and any secrets embedded in source files.
- Write to project files on disk:
POST /api/write pushes changes back
through Rojo's sync pipeline, allowing an attacker to inject arbitrary Lua
into the developer's project. If the developer then publishes their game,
the injected code executes on every player's client — a supply chain attack
vector.
- Launch local programs:
POST /api/open/{id} calls the OS-level
opener::open() function, which invokes the platform's default handler
(open on macOS, xdg-open on Linux, start on Windows) for the target
file.
Exploitation requires only that rojo serve is running (the standard Roblox
development workflow) and that the developer visits an attacker-controlled
webpage in any browser on the same machine. The port is a fixed well-known
default (34872), there is no authentication, and no user interaction is needed
beyond the initial page visit.
The flaw was corrected in #1270,
which adds Host/Origin header validation to reject cross-origin requests,
gates /api/open to loopback clients regardless of validated origin, and emits
a warning when the server binds to a non-loopback address
Reported by Aiden Mohan.
Advisory available under CC0-1.0
license.