CVE-2025-13805: nutzam NutzBoot RCE Vulnerability

CVE-2025-13805 Overview

CVE-2025-13805 identifies an insecure deserialization weakness in nutzam NutzBoot versions up to 2.6.0-SNAPSHOT. The flaw resides in the getInputStream function of nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java, part of the LiteRpc-Serializer component. An attacker can manipulate the input stream to trigger unsafe deserialization of attacker-controlled data. The attack is reachable over the network, but exploitation complexity is high and reliable execution is reported as difficult. A public proof-of-concept has been released, increasing the likelihood of opportunistic probing against exposed NutzBoot RPC endpoints.

Critical Impact

Successful exploitation enables deserialization of attacker-supplied data through the LiteRpc HTTP endpoint, with public proof-of-concept code available.

Affected Products

• nutzam NutzBoot versions up to and including 2.6.0-SNAPSHOT
• NutzBoot LiteRpc-Serializer component (nutzcloud-literpc)
• Applications embedding the HttpServletRpcEndpoint class

Discovery Timeline

• 2025-12-01 - CVE-2025-13805 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13805

Vulnerability Analysis

The vulnerability is an insecure deserialization issue classified under [CWE-20] Improper Input Validation. The defect sits in the LiteRpc HTTP transport layer, where the RPC endpoint reads a request body through getInputStream and passes the bytes to a serializer that reconstructs Java objects. Because the endpoint does not constrain the set of classes that may be instantiated, an attacker who can reach the endpoint can submit a crafted payload that drives object construction along a gadget chain. Reachability is network-based and requires no authentication, but the attacker must satisfy non-trivial preconditions on serializer state and available gadgets, which is why the exploitability is rated difficult.

Root Cause

The HttpServletRpcEndpoint accepts a serialized RPC payload from HttpServletRequest.getInputStream() and hands it to the LiteRpc serializer without enforcing a class allowlist, schema, or integrity check. Trust is implicitly placed in remote callers, which violates safe-deserialization practice.

Attack Vector

An unauthenticated attacker sends an HTTP request containing a crafted serialized object to the exposed LiteRpc endpoint. During parsing, the serializer reconstructs the embedded object graph, invoking magic methods or constructors along the way. Depending on classes present on the classpath, this can escalate into arbitrary command execution.

No verified exploitation code is reproduced here. Technical specifics and a public proof-of-concept are documented in the GitHub RCE Report and the GitHub RCE PoC Details.

Detection Methods for CVE-2025-13805

Indicators of Compromise

• HTTP POST requests to LiteRpc endpoints carrying binary or base64-encoded Java serialization headers such as the 0xAC 0xED 0x00 0x05 magic bytes.
• Unexpected child processes spawned by the NutzBoot JVM, including sh, bash, cmd.exe, or powershell.exe.
• Outbound network connections from the NutzBoot process to unfamiliar hosts shortly after RPC traffic.
• Stack traces in application logs referencing HttpServletRpcEndpoint.getInputStream followed by deserialization exceptions.

Detection Strategies

• Inspect HTTP request bodies bound for LiteRpc URIs for serialized-Java signatures and known gadget class names such as CommonsCollections, Rome, or Hibernate.
• Apply runtime application self-protection or Java agents that hook ObjectInputStream.resolveClass and alert on unexpected class resolution.
• Correlate web access logs with process-creation telemetry on hosts running NutzBoot to surface RPC-triggered command execution.

Monitoring Recommendations

• Enable verbose logging on the NutzBoot RPC endpoint and forward events to a centralized analytics platform for retention and search.
• Baseline normal RPC client IP ranges and alert on requests from outside that population.
• Track JVM exception rates for java.io.InvalidClassException and ClassNotFoundException, which often spike during failed deserialization exploitation attempts.

How to Mitigate CVE-2025-13805

Immediate Actions Required

• Restrict network exposure of NutzBoot LiteRpc endpoints to trusted internal networks using firewalls or service-mesh policies.
• Place an authenticating reverse proxy in front of HttpServletRpcEndpoint so unauthenticated requests cannot reach the deserializer.
• Audit the application classpath and remove unused libraries known to provide deserialization gadgets.
• Review logs for prior requests matching the indicators above and triage any hosts showing unexpected child processes.

Patch Information

At the time of publication, no fixed release from the upstream nutzam NutzBoot project is referenced in the advisory data. Affected operators should track the project repository for a release succeeding 2.6.0-SNAPSHOT and consult VulDB #333815 for updates.

Workarounds

• Disable the LiteRpc HTTP endpoint entirely if the RPC functionality is not required by the application.
• Implement a serialization allowlist by subclassing ObjectInputStream and overriding resolveClass to reject any class not explicitly required.
• Front the endpoint with a web application firewall rule that blocks request bodies beginning with the Java serialization magic header.
• Require mutual TLS or bearer-token authentication on the RPC route to eliminate unauthenticated reachability.

# Example nginx configuration blocking LiteRpc access from untrusted networks
location /literpc/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://nutzboot_backend;
}