Executive brief
BizTalk360 is a management and monitoring platform for Microsoft BizTalk Server environments. A security flaw allows any user with access to the network—even those without administrative privileges—to upload and execute malicious code on the server. This could lead to a complete takeover of the system, unauthorized access to business data, and disruption of automated business processes.
Technical details
A vulnerability exists in BizTalk360 due to missing authorization checks in several WCF service endpoints. Specifically, the 'ValidateNotificationChannel' endpoint in the AlertServiceManagement class fails to invoke 'ApiSecurityHelper' for permission validation, allowing any authenticated user to specify a DLL path. Because the application also exposes an unrestricted file upload endpoint ('/UploadFile' in AnalyticsDataService), an attacker can upload a malicious DLL and then trigger its execution by providing its path to the vulnerable loading service. If the uploaded assembly implements the 'IChannelNotification' interface, it is instantiated upon loading, resulting in remote code execution (RCE) with the privileges of the service account. This issue is fixed in version 11.6.3963.2611.
Affected products
- Kovai.co BizTalk360 < 11.6.3963.2611
Timeline
- 2025-06-27: other: First contact with vendor
- 2025-08-18: patched: Initial fix in version 11.5
- 2025-12-03: patched: Final fix in version 11.6.3963.2611 released
- 2026-04-03: disclosed: Public advisory released