Summary
Paperclip contains an operating system command injection vulnerability in execution workspace configuration. An attacker who holds an agent API key may be able to influence workspace command settings, causing attacker-chosen commands to run as the Paperclip server process when the workspace is archived.
Paperclip contains an operating system command injection vulnerability in execution workspace configuration. An attacker who holds an agent API key may be able to influence workspace command settings, causing attacker-chosen commands to run as the Paperclip server process when the workspace is archived.
Affected context
The issue occurs in Paperclip execution workspaces when command-related fields can be modified through the workspace API and are later passed to a shell during artifact cleanup. Risk depends on the API key's ability to update workspace configuration and on the privileges available to the Paperclip server process.
The issue occurs in Paperclip execution workspaces when command-related fields can be modified through the workspace API and are later passed to a shell during artifact cleanup. Risk depends on the API key's ability to update workspace configuration and on the privileges available to the Paperclip server process.
Exploit preconditions
- Attack surface: Paperclip's execution workspace API
- Required access: A valid agent API key with permission to modify the target workspace
- Trigger point: Workspace archival, when cleanup processing executes configured commands
- Why exploitation is possible: User-influenced command values are executed through a shell with the server process's operating-system privileges
- Attack surface: Paperclip's execution workspace API
- Required access: A valid agent API key with permission to modify the target workspace
- Trigger point: Workspace archival, when cleanup processing executes configured commands
- Why exploitation is possible: User-influenced command values are executed through a shell with the server process's operating-system privileges
Why this happens
The vulnerability results from treating API-controlled command configuration as trusted shell input. The application permits command fields to reach a shell execution path without sufficiently separating data from executable instructions, allowing shell metacharacters or attacker-controlled command content to alter process behavior. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
The vulnerability results from treating API-controlled command configuration as trusted shell input. The application permits command fields to reach a shell execution path without sufficiently separating data from executable instructions, allowing shell metacharacters or attacker-controlled command content to alter process behavior. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- An attacker could execute arbitrary operating-system commands on the Paperclip server host.
- The attacker may access, alter, or delete data available to the server process.
- Compromise could enable credential theft, service disruption, or persistence.
- The vulnerability could facilitate lateral movement if the process has network access or excessive privileges.
- An attacker could execute arbitrary operating-system commands on the Paperclip server host.
- The attacker may access, alter, or delete data available to the server process.
- Compromise could enable credential theft, service disruption, or persistence.
- The vulnerability could facilitate lateral movement if the process has network access or excessive privileges.
General mitigation guidance
Mitigation generally focuses on eliminating shell interpretation for attacker-influenced values and reducing the trust placed in API-managed command settings.
Common defensive patterns include:
- Replace shell-based execution with fixed, allowlisted operations and argument arrays.
- Treat command configuration as untrusted input and reject unexpected values through strict schemas.
- Separate cleanup behavior from user-controlled workspace fields.
- Apply strong authorization boundaries to workspace updates and narrowly scope agent API keys.
- Run the Paperclip service with a dedicated least-privilege account and restricted filesystem and network access.
- Use isolation controls so cleanup tasks cannot inherit unnecessary host capabilities.
Mitigation generally focuses on eliminating shell interpretation for attacker-influenced values and reducing the trust placed in API-managed command settings.
Common defensive patterns include:
- Replace shell-based execution with fixed, allowlisted operations and argument arrays.
- Treat command configuration as untrusted input and reject unexpected values through strict schemas.
- Separate cleanup behavior from user-controlled workspace fields.
- Apply strong authorization boundaries to workspace updates and narrowly scope agent API keys.
- Run the Paperclip service with a dedicated least-privilege account and restricted filesystem and network access.
- Use isolation controls so cleanup tasks cannot inherit unnecessary host capabilities.
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving shell execution APIs, command concatenation, or dynamically constructed cleanup commands.
- Code review signals where request fields are assigned to process, shell, or subprocess execution functions.
- Authorization reviews covering API endpoints that modify executable configuration.
- Runtime monitoring for unexpected child processes, shell interpreters, or command execution during workspace archival.
- Policy enforcement that prohibits shell invocation with request-derived values and requires allowlisted executable paths.
Automated application security and code review tools may help identify these patterns when configured for command injection rules.
Organizations can look for:
- Static analysis findings involving shell execution APIs, command concatenation, or dynamically constructed cleanup commands.
- Code review signals where request fields are assigned to process, shell, or subprocess execution functions.
- Authorization reviews covering API endpoints that modify executable configuration.
- Runtime monitoring for unexpected child processes, shell interpreters, or command execution during workspace archival.
- Policy enforcement that prohibits shell invocation with request-derived values and requires allowlisted executable paths.
Automated application security and code review tools may help identify these patterns when configured for command injection rules.
