External risk intelligence

Antabot White-Jotter Unauthenticated Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60803

The vulnerability exists in an API endpoint (/api/aaa;/../register) within the application. Web APIs are commonly deployed as internet-facing services to facilitate communication, making this interface a likely target for remote access in standard deployments.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Antabot White-Jotter application, specifically affecting its registration API. This issue could allow unauthenticated remote code execution, meaning an attacker could potentially gain control of the system without needing any credentials. The main concern is confirming if this specific component is used and exposed within our environment.

Unauthenticated remote code execution flaw.
Potential for system compromise without credentials.
Confirm relevance and exposure in our systems.

Attack Path

How an attacker could exploit the issue

An attacker can target the White-Jotter application by sending a specially crafted request to an API endpoint. This endpoint, exposed without requiring authentication, allows an unauthenticated remote attacker to achieve code execution. The vulnerability lies in how the application handles requests to a registration endpoint.

Entry Condition: Network access to the application's API.
Trigger Point: Sending a malicious request to the registration endpoint.
Resulting Risk: Unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely when supported by the advisory. This means that an attacker could potentially gain control of the affected system by exploiting this flaw through a network connection.

System access and control.
Remote code execution via API.
Compromise of the affected system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated remote code execution vulnerability in White-Jotter's registration API requires immediate attention to identify affected systems, assess business criticality and exposure, and assign ownership for remediation. The first practical step is to locate all instances of White-Jotter, determine their accessibility and importance, and confirm the accountable owner before planning and executing a risk-based response.

Application owners and infrastructure teams should own this issue.
Verify internet-facing and critical instances first.
Plan remediation or mitigation urgently.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Antabot White-Jotter?

Antabot White-Jotter is a software application designed for collaborative note-taking and documentation. It provides various web-based interfaces, including API endpoints, to manage user registrations and content storage, serving as a centralized hub for teams to organize and share information within their digital environments.

What does CVE-2025-60803 mean?

This CVE refers to a critical vulnerability classified as CWE-78, or OS Command Injection. It occurs when an application improperly filters input before passing it to a system shell. In this case, the flaw allows an attacker to send unauthorized commands that the server executes, effectively granting them control over the underlying system without needing a login.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker sends a specially crafted network request to the application's registration API endpoint. The bug does not require any prior authentication or special user privileges to activate. It is important to note that standard, legitimate interactions with the registration page that do not use the specific malformed API path will not trigger this issue.

Is my system at risk from CVE-2025-60803?

According to the Halo Surface Signal, this vulnerability is likely to impact your systems if the affected API endpoint is internet-facing. Because this component is commonly exposed to facilitate web communication, services accessible from the public internet are at higher risk of remote targeting compared to those strictly restricted to internal, private networks.

How should I respond to this threat?

Begin by creating an inventory of all White-Jotter instances running in your environment to determine which are critical or exposed to the internet. Once located, verify the ownership of these systems and coordinate with the relevant infrastructure teams. Prioritize these instances for risk assessment and prepare for remediation to secure the registration interface against unauthorized access.

References

github.com/Antabot/White-Jotter/issues/162

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.