Executive brief
NutzBoot is a Java application framework that includes a lightweight RPC component (LiteRpc) for network communication. An unauthenticated attacker can send specially crafted serialized Java objects to the HTTP endpoint without credentials, triggering unsafe deserialization that leads to remote code execution on the server, allowing an attacker to execute arbitrary commands with the application's privileges.
Technical details
The vulnerability exists in the getInputStream function of the HttpServletRpcEndpoint component within NutzBoot's LiteRpc module (org.nutz.boot.starter.literpc.impl.endpoint.http.HttpServletRpcEndpoint.java). The flaw is an unsafe Java deserialization issue where untrusted serialized objects are deserialized without proper validation. An unauthenticated attacker can exploit this by sending malicious serialized payloads over the network to the HTTP RPC endpoint, achieving remote code execution. The attack has high complexity but is characterized as difficult to exploit, though public exploits are available. Patches and fixed versions should be checked with the Nutz Framework maintainers.
Affected products
- Nutz Framework NutzBoot up to 2.6.0-SNAPSHOT
Timeline
- 2025-12-01: disclosed
- other: Public exploit available