Paperclip Flaw Let New Accounts Run Server Commands

Oasis Security disclosed a CVSS 10.0 hole in Paperclip that lets a self-registered account escalate to shell execution on the host, per SecurityWeek.

Any team running Paperclip's default authenticated mode to manage agents at scale is exposed. The entry cost is a working sign-up form: no invite, no verified mailbox, nothing that would normally gate account creation.

Registration is the only prerequisite. From there, an attacker creates a CLI authorization challenge and approves it themselves, minting a board-level API token.

That token was supposed to unlock only board-scoped actions. It also worked against the company-import route, which was supposed to require instance-admin privileges instead.

Company-import accepts a .paperclip.yaml file that defines an agent configuration. Point that config at a host-level execution adapter and the import runs shell commands on the server, no admin account ever touched.

The same report flags a second bug. Paperclip's local-dev mode trusts anything that reaches 127.0.0.1, so an attacker-controlled webpage can use DNS rebinding to run commands on a developer's own machine.

SecurityWeek's writeup doesn't say whether a patched version is out or how long the bug sat in production instances.

The access check is the real design flaw here. A token scoped to board-level actions worked on a route that was supposed to require instance-admin privileges. Patching company-import alone won't close that gap if the same flaw exists on other admin-only routes.