CVE-2025-8708
📋 TL;DR
This vulnerability in Antabot White-Jotter 0.22 allows remote attackers to execute arbitrary code through deserialization of untrusted data in the CookieRememberMeManager function. It affects systems running White-Jotter with the vulnerable Shiro configuration component. The attack complexity is high but exploitation is possible with publicly disclosed information.
💻 Affected Systems
- Antabot White-Jotter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Authentication bypass and session hijacking allowing unauthorized access to the White-Jotter application.
If Mitigated
Limited impact with proper input validation and deserialization controls in place.
🎯 Exploit Status
Exploit has been publicly disclosed but exploitation appears difficult according to vulnerability description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub issues for updated version
Vendor Advisory: https://github.com/Antabot/White-Jotter/issues/161
Restart Required: Yes
Instructions:
1. Check GitHub issue #161 for patch details. 2. Update to patched version. 3. Restart White-Jotter application. 4. Verify fix implementation.
🔧 Temporary Workarounds
Disable RememberMe functionality
allTemporarily disable the vulnerable CookieRememberMeManager function
Modify ShiroConfiguration.java to remove or disable CookieRememberMeManager
Implement input validation
allAdd validation for deserialization inputs to prevent malicious payloads
Implement whitelist for deserialization classes in Shiro configuration
🧯 If You Can't Patch
- Implement network segmentation to isolate White-Jotter instances
- Deploy WAF rules to block deserialization attack patterns
🔍 How to Verify
Check if Vulnerable:
Check if running White-Jotter version 0.22 and examine ShiroConfiguration.java for vulnerable CookieRememberMeManager implementationCheck Version:
Check application version in White-Jotter configuration or deployment filesVerify Fix Applied:
Verify that CookieRememberMeManager has been patched or replaced with secure implementation📡 Detection & Monitoring
Log Indicators:
- Unusual deserialization errors
- Failed authentication attempts with RememberMe tokens
- Unexpected process execution
Network Indicators:
- HTTP requests with suspicious RememberMe cookie values
- Unusual outbound connections from White-Jotter server
SIEM Query:
source="white-jotter-logs" AND (error="deserialization" OR cookie="EVANNIGHTLY_WAOU")