MalwarePublished 22 Jun 2025

Just casually broke bunq’s sandbox with 0day-level spoofing, and nobody seems to care 🇳🇱

Source Reddit NetSec

Description

So I cooked up a fake transaction for shits and giggles. No valid IBAN. No real user. No device. No signature. No token. No nothing. Just pure distilled bullshit in a JSON payload. Guess what? “Transaction accepted” “attack_success”: true “fraud_score”: 0.99999 System looked at it and said: “yeah, looks good to me.” I even told the sandbox I was sending 10k EUR from FAKE_IBAN_901 to INVALID_IBAN_123 using a spoofed IMEI and some RSA nonsense I made up in Notepad. Bunq backend? Nodded politely

Impact

For European organizations, especially financial institutions and fintech companies, this vulnerability highlights the risks of inadequate transaction validation and authentication controls. If such a flaw exists beyond the sandbox environment, attackers could initiate fraudulent transactions without possessing valid user credentials or device identifiers, leading to unauthorized fund transfers, financial losses, and erosion of customer trust. The integrity of transaction data would be severely compromised, and the availability of reliable banking services could be disrupted if attackers exploit this to flood systems with bogus transactions. Additionally, regulatory compliance risks arise, as financial institutions in Europe must adhere to strict standards such as PSD2 and GDPR, which mandate strong authentication and fraud prevention measures. The reputational damage and potential legal consequences from such a breach could be substantial. Moreover, the demonstrated ease of exploitation—no authentication or valid data required—means that threat actors with minimal technical skill could attempt to leverage this vulnerability, increasing the attack surface and urgency for remediation.

Defensive guidance

1. Conduct an immediate comprehensive audit of transaction validation logic in both sandbox and production environments to identify and remediate input validation weaknesses. 2. Implement strict authentication and authorization checks for all transaction requests, ensuring that only valid users and devices with proper tokens and signatures can initiate transactions. 3. Enhance fraud detection algorithms to incorporate multi-factor verification and anomaly detection that cannot be bypassed by spoofed identifiers or fabricated cryptographic data. 4. Introduce robust cryptographic validation of transaction payloads, including signature verification against trusted keys and rejection of any malformed or unverifiable data. 5. Segregate sandbox and production environments with strict access controls to prevent sandbox vulnerabilities from impacting live systems. 6. Perform regular penetration testing and code reviews focused on transaction processing components to detect similar logic flaws. 7. Educate development and security teams on secure coding practices related to financial transaction handling. 8. Monitor transaction logs for unusual patterns indicative of exploitation attempts and establish rapid incident response protocols. 9. Engage with external security researchers and bug bounty programs to encourage responsible disclosure of vulnerabilities.

Summary

The reported security threat involves a critical vulnerability in bunq's sandbox environment, a digital banking platform primarily operating in the Netherlands. The researcher demonstrated the ability to submit a completely fabricated transaction payload containing invalid IBANs, spoofed device identifiers (IMEI), and fabricated cryptographic signatures without any valid authentication tokens or user credentials. Despite the lack of any legitimate transaction data or cryptographic proof, the sandbox backend accepted the transaction as valid, assigning it a near-perfect fraud score (0.99999) and marking the attack as successful. This indicates a fundamental flaw in the transaction validation logic within the sandbox environment, allowing unauthenticated and unauthorised transaction requests to be processed without proper verification. Although this was demonstrated in a sandbox environment, the implications suggest that similar validation weaknesses could exist in production systems, potentially enabling attackers to spoof transactions, bypass fraud detection, and manipulate financial operations. The absence of any patch or known exploits in the wild suggests this issue is newly discovered and not yet exploited at scale. The vulnerability stems from insufficient input validation, authentication bypass, and inadequate fraud detection mechanisms, which together create a high-risk scenario for financial fraud and system compromise.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2025, 02:49 UTC

Technical details

References

Community reviews

Related threats