Agent-Zero Insecure Permissions Allow Arbitrary System Reset Vulnerability

A vulnerability in Agent-Zero versions 0.8.* has been identified, allowing unauthenticated attackers to arbitrarily restart the system, leading to a denial-of-service condition. This issue arises from insecure permissions that expose the 'restart/pause' method, causing the system to become unresponsive for a period before recovering.

Impact

Exploitation of this vulnerability causes the system to become unresponsive, leading to a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a request to the '/restart/pause' endpoint. The system will become unresponsive but will recover after some time.

Remediation

Users are advised to upgrade to Agent-Zero version 0.9 or later, where this vulnerability has been fixed.