Ajenti Admin Panel Privilege Escalation to Root Code Execution

Ajenti, a Linux & BSD modular server admin panel, has a privilege escalation vulnerability. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization.

InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission.

• Affected versions: prior to 2.2.16
• Precondition: any authenticated user
• Impact: root code execution and full host compromise
• Fixed in: 2.2.16