CVE-2025-13806
📋 TL;DR
This vulnerability allows unauthorized Ethereum transactions through NutzBoot's Transaction API. Attackers can manipulate 'from/to/wei' parameters to execute transfers without proper authorization checks. Systems running NutzBoot up to version 2.6.0-SNAPSHOT with the vulnerable EthModule component are affected.
💻 Affected Systems
- nutzam NutzBoot
📦 What is this software?
Nutzboot by Nutzam
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of Ethereum funds from vulnerable wallets, unauthorized transfers to attacker-controlled addresses, and potential chain reaction if the vulnerable component is used in financial applications.
Likely Case
Unauthorized transfer of Ethereum funds from vulnerable wallets to attacker addresses, with the amount limited by available wallet balances.
If Mitigated
No impact if proper network segmentation, API authentication, and transaction signing controls are implemented.
🎯 Exploit Status
Public exploit code is available in GitHub repositories, making exploitation straightforward for attackers with network access to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Upgrade to a version beyond 2.6.0-SNAPSHOT when released, or implement workarounds.
🔧 Temporary Workarounds
Disable vulnerable EthModule
allRemove or disable the nutzboot-demo-simple-web3j module containing the vulnerable EthModule.java file
Remove or comment out EthModule.java from your project
Disable web3j integration if not required
Implement API authentication
allAdd authentication and authorization checks to all Transaction API endpoints
Implement JWT or API key authentication
Add role-based access controls to transaction endpoints
🧯 If You Can't Patch
- Network segmentation: Isolate the vulnerable component from internet access and restrict to internal networks only
- Implement Web Application Firewall (WAF) rules to block suspicious transaction patterns and parameter manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Check if your project includes nutzboot-demo-simple-web3j module and EthModule.java file. Verify NutzBoot version is ≤2.6.0-SNAPSHOT.Check Version:
Check pom.xml or build.gradle for NutzBoot version, or run: java -jar your-app.jar --versionVerify Fix Applied:
Test transaction endpoints with unauthorized requests to ensure proper authentication and authorization checks are in place.📡 Detection & Monitoring
Log Indicators:
- Unauthorized transaction attempts
- Failed authentication on transaction endpoints
- Unusual from/to address patterns in transaction logs
Network Indicators:
- HTTP requests to transaction endpoints without authentication headers
- Unusual transaction patterns or amounts
SIEM Query:
source="application.logs" AND ("EthModule" OR "transaction" OR "transfer") AND (status="401" OR status="403")🔗 References
- https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md
- https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md#vulnerability-details-and-poc
- https://vuldb.com/?ctiid.333816
- https://vuldb.com/?id.333816
- https://vuldb.com/?submit.692061
- https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md
- https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md#vulnerability-details-and-poc
