Attack Chain

1. Account Creation: The attacker creates a new account via the /api/auth/sign-up/email endpoint. No invite token or email verification is required.
2. Sign In: The attacker signs in with the newly created account via the /api/auth/sign-in/email endpoint, obtaining a session cookie.
3. CLI Auth Challenge Creation: The attacker creates a CLI auth challenge via the /api/cli-auth/challenges endpoint. No authentication is needed for this step. The response includes a token and boardApiToken.
4. CLI Auth Challenge Approval: The attacker approves the CLI auth challenge via the /api/cli-auth/challenges/<id>/approve endpoint using the session cookie obtained in step 2. The server only verifies that the caller is a board user, not that they are the challenge creator.
5. Company Import: The attacker exploits the missing assertInstanceAdmin check in the /api/companies/import endpoint to import a malicious company configuration. This configuration includes an agent with a process adapter that specifies a command to execute.
6. Agent Trigger: The attacker triggers the malicious agent via the /api/agents/<agent-id>/wakeup endpoint.
7. Command Execution: The process adapter executes the attacker-specified command (e.g., bash -c "id > /tmp/pwned.txt && ..."), resulting in code execution as the server's OS user.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands as the Paperclip server's OS user. This grants:

• Full filesystem access (read/write as the server user)
• Access to all data in the Paperclip database
• Ability to pivot to internal network services
• Ability to disrupt all agent operations

The attack is fully automated and works against the default deployment configuration, posing a critical risk to affected systems.

Recommendation

• Disable open registration by default: Modify server/src/config.ts:172 to change ?? false to ?? true and document PAPERCLIP_AUTH_DISABLE_SIGN_UP in the deployment guide.
• Prevent CLI auth self-approval: Modify server/src/routes/access.ts around line 1700 to reject when the approving user is the same user who created the challenge.
• Require email verification: Modify server/src/auth/better-auth.ts:91 to set requireEmailVerification: true.
• Add assertInstanceAdmin to the import endpoint for new_company mode: Modify server/src/routes/companies.ts, lines 161-176, to include the assertInstanceAdmin check for POST /import and POST /import/preview when mode is set to new_company.
• Monitor web server logs for POST requests to /api/companies/import that do not originate from an instance administrator to detect potential exploitation attempts, utilizing the rule below.

Attack Chain

1. The attacker obtains a valid Agent API key through legitimate means or compromise.
2. The attacker sends a PATCH request to the /api/agents/:id endpoint, targeting a specific agent.
3. The PATCH request modifies the agent's adapterConfig, specifically injecting a malicious command into the adapterConfig.workspaceStrategy.provisionCommand field. For example: echo PAPERCLIP_RCE > poc_rce.txt.
4. The attacker triggers workspace provisioning by sending a POST request to the /api/agents/:id/wakeup endpoint.
5. The Paperclip server executes the workspace provisioning routine, which includes running the command specified in adapterConfig.workspaceStrategy.provisionCommand.
6. The server executes the injected command using /bin/sh -c, effectively running arbitrary shell commands on the host.
7. The injected command executes successfully, for example creating a file poc_rce.txt on the server filesystem.
8. The attacker gains remote code execution on the Paperclip server host, enabling them to read environment variables, exfiltrate secrets, or establish a reverse shell.

Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the Paperclip server, potentially leading to a full compromise of the deployment environment. Since Paperclip orchestrates multiple agents and repositories, attackers could read environment variables, exfiltrate secrets, modify repositories, access database credentials, execute reverse shells, and establish persistence on the host. The vulnerability allows a malicious agent to escape the orchestration layer and gain complete control over the server.

Recommendation

• Deploy the Sigma rule Detect Paperclip Agent Configuration Modification to detect unauthorized modifications to the agent configuration via the API.
• Apply the suggested minimal patch by implementing a server-side check to reject modifications to adapterConfig.workspaceStrategy.provisionCommand when the request is authenticated using an Agent API key, as detailed in the "Minimal Patch Suggestion" section of the advisory.
• Monitor process creation events for the execution of /bin/sh -c with command line arguments that originate from Paperclip agent configurations using the Sigma rule Detect Paperclip Command Execution via Workspace Provisioning.
• Upgrade to Paperclip version 2026.416.0 or later to patch the vulnerability.