Attack Chain

1. Account Creation: The attacker creates a new account via the /api/auth/sign-up/email endpoint. No invite token or email verification is required.
2. Sign In: The attacker signs in with the newly created account via the /api/auth/sign-in/email endpoint, obtaining a session cookie.
3. CLI Auth Challenge Creation: The attacker creates a CLI auth challenge via the /api/cli-auth/challenges endpoint. No authentication is needed for this step. The response includes a token and boardApiToken.
4. CLI Auth Challenge Approval: The attacker approves the CLI auth challenge via the /api/cli-auth/challenges/<id>/approve endpoint using the session cookie obtained in step 2. The server only verifies that the caller is a board user, not that they are the challenge creator.
5. Company Import: The attacker exploits the missing assertInstanceAdmin check in the /api/companies/import endpoint to import a malicious company configuration. This configuration includes an agent with a process adapter that specifies a command to execute.
6. Agent Trigger: The attacker triggers the malicious agent via the /api/agents/<agent-id>/wakeup endpoint.
7. Command Execution: The process adapter executes the attacker-specified command (e.g., bash -c "id > /tmp/pwned.txt && ..."), resulting in code execution as the server's OS user.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands as the Paperclip server's OS user. This grants:

• Full filesystem access (read/write as the server user)
• Access to all data in the Paperclip database
• Ability to pivot to internal network services
• Ability to disrupt all agent operations

The attack is fully automated and works against the default deployment configuration, posing a critical risk to affected systems.

Recommendation

• Disable open registration by default: Modify server/src/config.ts:172 to change ?? false to ?? true and document PAPERCLIP_AUTH_DISABLE_SIGN_UP in the deployment guide.
• Prevent CLI auth self-approval: Modify server/src/routes/access.ts around line 1700 to reject when the approving user is the same user who created the challenge.
• Require email verification: Modify server/src/auth/better-auth.ts:91 to set requireEmailVerification: true.
• Add assertInstanceAdmin to the import endpoint for new_company mode: Modify server/src/routes/companies.ts, lines 161-176, to include the assertInstanceAdmin check for POST /import and POST /import/preview when mode is set to new_company.
• Monitor web server logs for POST requests to /api/companies/import that do not originate from an instance administrator to detect potential exploitation attempts, utilizing the rule below.

Attack Chain

1. The attacker obtains a valid Agent API key through legitimate means or compromise.
2. The attacker sends a PATCH request to the /api/agents/:id endpoint, targeting a specific agent.
3. The PATCH request modifies the agent's adapterConfig, specifically injecting a malicious command into the adapterConfig.workspaceStrategy.provisionCommand field. For example: echo PAPERCLIP_RCE > poc_rce.txt.
4. The attacker triggers workspace provisioning by sending a POST request to the /api/agents/:id/wakeup endpoint.
5. The Paperclip server executes the workspace provisioning routine, which includes running the command specified in adapterConfig.workspaceStrategy.provisionCommand.
6. The server executes the injected command using /bin/sh -c, effectively running arbitrary shell commands on the host.
7. The injected command executes successfully, for example creating a file poc_rce.txt on the server filesystem.
8. The attacker gains remote code execution on the Paperclip server host, enabling them to read environment variables, exfiltrate secrets, or establish a reverse shell.

Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the Paperclip server, potentially leading to a full compromise of the deployment environment. Since Paperclip orchestrates multiple agents and repositories, attackers could read environment variables, exfiltrate secrets, modify repositories, access database credentials, execute reverse shells, and establish persistence on the host. The vulnerability allows a malicious agent to escape the orchestration layer and gain complete control over the server.

Recommendation

• Deploy the Sigma rule Detect Paperclip Agent Configuration Modification to detect unauthorized modifications to the agent configuration via the API.
• Apply the suggested minimal patch by implementing a server-side check to reject modifications to adapterConfig.workspaceStrategy.provisionCommand when the request is authenticated using an Agent API key, as detailed in the "Minimal Patch Suggestion" section of the advisory.
• Monitor process creation events for the execution of /bin/sh -c with command line arguments that originate from Paperclip agent configurations using the Sigma rule Detect Paperclip Command Execution via Workspace Provisioning.
• Upgrade to Paperclip version 2026.416.0 or later to patch the vulnerability.

Attack Chain

1. The attacker sends a GET request to /api/companies to obtain a company ID.
2. The attacker sends a GET request to /api/companies/{company_id}/execution-workspaces to enumerate execution workspaces and retrieve a workspace ID.
3. If the workspace is not in an active state, the attacker sends a PATCH request to /api/execution-workspaces/{workspace_id} with the body {"status": "active"} to reactivate it.
4. The attacker crafts a PATCH request to /api/execution-workspaces/{workspace_id} with a JSON body containing a malicious cleanupCommand within the config object, such as {"config": {"cleanupCommand": "echo RCE_PROOF > \\"/tmp/rce-proof.txt\\""}}.
5. The server stores the injected cleanupCommand in the workspace configuration.
6. The attacker triggers the command injection by sending a PATCH request to /api/execution-workspaces/{workspace_id} to archive the workspace, setting "status": "archived".
7. The server executes the injected command using child_process.spawn(shell, ["-c", cleanupCommand]).
8. The attacker achieves remote code execution on the server, potentially leading to data exfiltration, lateral movement, or other malicious activities.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the Paperclip server with the privileges of the server process. This can lead to a range of severe impacts, including remote code execution, data exfiltration of sensitive information (e.g., system info, environment variables, source code), lateral movement within the network, and potential supply chain attacks by injecting backdoors into managed repositories. In local_trusted mode, this requires zero authentication, making it easily exploitable by malicious local processes or web pages.

Recommendation

• Apply input validation to the cleanupCommand and teardownCommand fields in the PATCH handler to prevent the injection of malicious commands.
• Implement command allowlisting, permitting only a predefined set of safe commands for workspace cleanup.
• Replace spawn(shell, ["-c", command]) with execFile() using an argument array to mitigate shell metacharacter injection.
• Implement proper authorization checks BEFORE processing the PATCH request to validate user permissions.
• Deploy the Sigma rule DetectPaperclipCleanupCommandInjection to identify attempts to exploit this vulnerability via the PATCH request to /api/execution-workspaces/:id.
• Run cleanup commands in a sandboxed environment to minimize the impact of potential exploits.