CyberRota Analysis
AI-GeneratedAjenti versions prior to 2.2.16 are vulnerable, allowing authenticated users to exploit the /api/core/tasks/start endpoint to manipulate plugin installations and upgrades without proper authorization. This vulnerability can lead to root code execution, enabling low-privileged users to gain full control over the host system. Organizations using Ajenti for server management should prioritize patching to version 2.2.16 to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.