CyberRota Analysis
AI-GeneratedFUXA version 1.3.0 is vulnerable to an unauthenticated Remote Code Execution flaw when `secureEnabled` is set to `true`, allowing attackers to execute arbitrary code by exploiting the `POST /api/runscript` endpoint with a valid script ID and name. This vulnerability arises from improper authorization checks when the request includes `test: true`, enabling execution of attacker-supplied code instead of the intended script. Organizations using this software, particularly those with accessible server-side scripts, should prioritize upgrading to version 1.3.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.