Executive brief
NutzBoot is a Java-based application framework that includes Ethereum wallet functionality. A vulnerability in the Ethereum Wallet Handler component allows unauthenticated remote attackers to retrieve sensitive information, including wallet passwords, through improper access controls on the local accounts API. This could enable attackers to compromise cryptocurrency wallets and steal funds or other digital assets.
Technical details
The vulnerability is an information disclosure flaw in the Ethereum Wallet Handler component of NutzBoot, specifically affecting the Web3j integration in the nutzboot-demo-simple-web3j module. An unauthenticated remote attacker can access the /local/accounts API endpoint without proper authorization checks, allowing retrieval of sensitive wallet data including passwords. The vulnerable code path is in EthModule.java. The attack requires only network reachability to the exposed API endpoint and no authentication. Exploitation results in complete exposure of wallet credentials and associated sensitive information. Patched versions beyond 2.6.0-SNAPSHOT are expected to implement proper authorization controls on the accounts API.
Affected products
- Nutz NutzBoot up to 2.6.0-SNAPSHOT
Timeline
- 2025-12-01: disclosed
- exploited: Public exploit released