Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.

Paperclip versions before 0.3.1 are vulnerable to remote code execution via DNS rebinding attacks when running in the default local_trusted mode. The vulnerability stems from a failure to validate Host headers, allowing attackers to bypass security controls. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, leverages DNS rebinding to make authenticated API requests. These requests can then execute arbitrary commands through Paperclip's process adapter. The attack targets developers running Paperclip in local development environments. The fix was introduced in version 0.3.1. This type of attack is particularly dangerous as it exploits the trusted local environment assumption. Developers should upgrade to version 0.3.1 or later immediately to mitigate the risk.