Description
Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ajenti Project | Ajenti | 2.1.36 | — |
References
- ExploitDB-48929 exploit
- Ajenti GitHub Repository product
- VulnCheck Advisory: Ajenti 2.1.36 - Remote Code Execution third-party-advisory