BigAntSoft BigAnt Server Unauthenticated Remote Code Execution Vulnerability via Account Registration

A remote code execution vulnerability has been identified in BigAntSoft BigAnt Server versions through 5.6.06. This vulnerability allows unauthenticated attackers to create administrative accounts using the default SaaS registration mechanism. After gaining administrative access, attackers can upload and execute arbitrary PHP code through the 'Cloud Storage Addin', leading to unauthorized code execution.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server with system-level privileges.

Reproduction

Exploitation requires two steps. First, the CAPTCHA verification must be bypassed by solving a CAPTCHA challenge presented during the registration process. After obtaining the CAPTCHA solution, an account can be registered. Once the account is created, the 'Cloud Storage Addin' can be accessed to upload a PHP file, which can then be executed remotely.