Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

QFinch assessment

Paperclip contains a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime using: As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host.

Potential impact

Successful exploitation allows: Potential attacker actions: Because Paperclip orchestrates multiple agents and repositories, this can lead to full compromise of the deployment environment. This effectively allows a malicious agent to escape the orchestration layer and execute arbitrary commands on the server host.

Technical context

Rootcause Agent configuration can be modified through the API endpoint: The validation schema allows arbitrary configuration fields: This allows attackers to inject arbitrary keys into the adapter configuration object. Later, during workspace provisioning, the server runtime executes a shell command derived directly from this configuration. Relevant code path: Example logic: Inside runWorkspaceCommand the command is executed using: Because no validation, escaping, or allowlist is applied, attacker-controlled configuration becomes a direct OS command execution primitive. Affected Files Functions involved: Attacker Model Required privileges: Attacker needs: This credential is intended for agent automation and should not grant host-level execution privileges. Agent credentials may also be exposed to external runtimes, plugins, or third-party agent providers. Allowing such credentials to configure host-executed commands creates a privilege escalation vector. No board or administrator access is required. Attacker Chain Complete exploit chain: Trust Boundary Violation Paperclip’s architecture assumes the following separation: This allows an agent to execute commands outside its intended permissions. Why This Is a Vulnerability (Not Expected Behavior) The provisionCommand field appears intended for trusted operators configuring workspace strategies. However, the current API design allows agents themselves to modify this configuration. Because agent credentials are designed for automation and may be exposed to agent runtimes, plugins, or external providers, allowing them to configure commands executed by the host introduces a privilege escalation vector. Therefore: The vulnerability arises from insufficient separation between configuration authority and execution authority.