Attack Chain

1. Account Creation: The attacker creates a new account via the /api/auth/sign-up/email endpoint. No invite token or email verification is required.
2. Sign In: The attacker signs in with the newly created account via the /api/auth/sign-in/email endpoint, obtaining a session cookie.
3. CLI Auth Challenge Creation: The attacker creates a CLI auth challenge via the /api/cli-auth/challenges endpoint. No authentication is needed for this step. The response includes a token and boardApiToken.
4. CLI Auth Challenge Approval: The attacker approves the CLI auth challenge via the /api/cli-auth/challenges/<id>/approve endpoint using the session cookie obtained in step 2. The server only verifies that the caller is a board user, not that they are the challenge creator.
5. Company Import: The attacker exploits the missing assertInstanceAdmin check in the /api/companies/import endpoint to import a malicious company configuration. This configuration includes an agent with a process adapter that specifies a command to execute.
6. Agent Trigger: The attacker triggers the malicious agent via the /api/agents/<agent-id>/wakeup endpoint.
7. Command Execution: The process adapter executes the attacker-specified command (e.g., bash -c "id > /tmp/pwned.txt && ..."), resulting in code execution as the server's OS user.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands as the Paperclip server's OS user. This grants:

• Full filesystem access (read/write as the server user)
• Access to all data in the Paperclip database
• Ability to pivot to internal network services
• Ability to disrupt all agent operations

The attack is fully automated and works against the default deployment configuration, posing a critical risk to affected systems.

Recommendation

• Disable open registration by default: Modify server/src/config.ts:172 to change ?? false to ?? true and document PAPERCLIP_AUTH_DISABLE_SIGN_UP in the deployment guide.
• Prevent CLI auth self-approval: Modify server/src/routes/access.ts around line 1700 to reject when the approving user is the same user who created the challenge.
• Require email verification: Modify server/src/auth/better-auth.ts:91 to set requireEmailVerification: true.
• Add assertInstanceAdmin to the import endpoint for new_company mode: Modify server/src/routes/companies.ts, lines 161-176, to include the assertInstanceAdmin check for POST /import and POST /import/preview when mode is set to new_company.
• Monitor web server logs for POST requests to /api/companies/import that do not originate from an instance administrator to detect potential exploitation attempts, utilizing the rule below.