A critical authorization bypass in the NutzBoot Web3j component enables unauthenticated remote attackers to drain configured Ethereum wallets, posing a severe financial risk.

The vulnerability exists in the EthModule.sendTransaction method within the Web3j demo module, which lacks any authentication or authorization checks. An unauthenticated attacker can trigger unauthorized financial transactions by sending a specially crafted GET request to the /web3j/eth/sendTransaction/ endpoint.

This vulnerability carries a high impact as it allows for direct financial theft by enabling unauthorized transfers of cryptocurrency from the server's configured wallets. With a CVSS score of 7.3, the risk of significant capital loss and potential compromise of backend wallet credentials is high. The ease of exploitation, requiring only a simple HTTP GET request, necessitates immediate attention to prevent unauthorized fund depletion.

Immediate Action: Remove the vulnerable EthModule helper API from all public-facing deployments immediately, as no official patch is currently available.

Proactive Monitoring: Review web server access logs for any requests directed to the /web3j/eth/sendTransaction/ path, especially those originating from untrusted or external IP addresses.

Compensating Controls: Implement strict network-level access control lists (ACLs) to block all external access to the affected web application endpoints. Deploy a Web Application Firewall (WAF) to filter and drop requests containing the /web3j/eth/ URI pattern.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the researcher write-up at the provided GitHub repository.

Given the severity of potential financial loss, organizations must prioritize the removal of the vulnerable demo module from production environments. If the functionality is required, it must be moved behind robust authentication and authorization layers that require explicit manual approval for any outgoing transaction. Failure to secure this endpoint exposes the organization to immediate and irreversible financial theft.