One post tagged with "dns-rebinding"

Somebody on your team writes a small helper for the editor. It is a Fiber app on 127.0.0.1:7777 that lists and reads files from the current project, so an editor plugin or a coding agent can ask it for context. It has no authentication, because it only listens on loopback and "nothing outside this machine can reach it". That sentence is half true. Nothing outside the machine can open a connection to it. But the browser on the same machine can, and the browser runs code from every website its user visits.

Over the past months, several Model Context Protocol servers received advisories for exactly this setup, among them genieacs-mcp, whose Streamable HTTP transport listened on 127.0.0.1:8080 without checking Host or Origin. The attack behind them is called DNS rebinding, and it is older than most of the tools it now hits. This post shows how it works, why the usual browser defenses do not notice it, and how the hostauthorization middleware that shipped in Fiber v3.3.0 closes the hole, for local tools and for public servers. Everything was built and tested against Fiber v3.6.1, which needs Go 1.26. The example also uses c.Origin(), which arrived in v3.6.0.