| 제목 | Nutz Framework NutzBoot 2.6.0-SNAPSHOT Code Execution (Unauthenticated Java Deserialization) |
|---|
| 설명 | An exposed LiteRPC HTTP endpoint allows arbitrary deserialization of attacker‑controlled data. The server expects the following headers: LiteRpc-Klass, LiteRpc-Method, and LiteRpc-Serializer. If all three are present, the endpoint looks up the serializer by name and blindly calls serializer.read(req.getInputStream()), trusting the client-provided serializer (HttpServletRpcEndpoint.java:47-110).
LiteRPC registers JdkRpcSerializer by default, and that serializer is chosen whenever the client sets LiteRpc-Serializer: jdk. The serializer wraps the request body in ObjectInputStream and invokes readObject() (lines 18-28). No filtering occurs before object graph creation, so any gadget chain available on the classpath can be triggered.
Service discovery through Loach amplifies the issue: /loach/v1/list and /loach/v1/list/forlook expose the LiteRpc.RPC_REG_KEY metadata that contains every registered RPC interface with its hashed method signatures. Therefore, an attacker can enumerate valid values for LiteRpc-Klass and LiteRpc-Method without guessing, guaranteeing that the invocation will reach a real RpcInvoker and the deserialization code path will execute.
Because neither /literpc/endpoint nor the Loach list endpoints enforce authentication or network restrictions in code, this becomes a pre-authentication remote code execution vulnerability. |
|---|
| 원천 | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-RCE-1/report.md |
|---|
| 사용자 | sh7err03 (UID 92418) |
|---|
| 제출 | 2025. 11. 10. AM 11:15 (11 개월 ago) |
|---|
| 모더레이션 | 2025. 11. 30. PM 03:13 (20 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 333815 [nutzam NutzBoot 까지 2.6.0-SNAPSHOT LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream 권한 상승] |
|---|
| 포인트들 | 20 |
|---|