Ajenti Authentication Bypass Vulnerability Leading to Remote Code Execution

An authentication bypass vulnerability has been identified in Ajenti version 2.1.36. This vulnerability allows remote attackers to execute arbitrary commands after successfully logging in. Exploitation involves using the '/api/terminal/create' endpoint to send a netcat reverse shell payload to a specified IP address and port.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where Ajenti is running.

Reproduction

To reproduce this vulnerability, log into the Ajenti server using valid credentials. Once authenticated, send a POST request to the '/api/terminal/create' endpoint with a payload that includes a command to establish a reverse shell connection using netcat. Specify the desired IP address and port for the reverse shell connection. After sending the payload, check the listener on the specified IP and port for the incoming connection.