This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: FUXA v1.1.13 suffers from **Remote Code Execution (RCE)** via the `/api/runscript` endpoint.β¦
π‘οΈ **Root Cause**: **Command Injection** due to lack of input sanitization. π **Flaw**: The `code` parameter in POST requests is passed directly to Node.js `child_process.exec()` without validation.β¦
π’ **Affected**: FUXA (Open-source SCADA/HMI/Dashboard software). π¦ **Version**: Specifically **v1.1.13**. π **Component**: The scripting component exposed via the `/api/runscript` API route.
Q4What can hackers do? (Privileges/Data)
π» **Privileges**: Commands execute with the privileges of the **FUXA service user**. π **Data**: Full read/write access to server files, ability to install backdoors, or pivot to other internal systems.β¦
π **Auth Status**: **UNAUTHENTICATED**. πͺ **Threshold**: **LOW**. Attackers do not need to log in. π‘ **Config**: Only requires network access to the `/api/runscript` endpoint. Anyone on the network can exploit it.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exploits**: **YES**. Multiple PoCs exist on GitHub (e.g., `rodolfomarianocy`, `btar1gan`). π οΈ **Tools**: Automated scripts available (Python-based) and Nuclei templates for rapid scanning.β¦
π **Self-Check**: Send a crafted POST request to `/api/runscript` with a test command in the `code` field. π‘ **Scanning**: Use **Nuclei** with the CVE-2023-33831 template.β¦
π οΈ **Fix**: Upgrade FUXA to a patched version (check official release notes for versions > 1.1.13). π **Note**: The provided data does not specify the exact fixed version, but patching is the primary mitigation.β¦
π§ **Workaround**: If patching is impossible, **block external access** to the `/api/runscript` endpoint via firewall/WAF. π **Restrict**: Disable the scripting feature if not needed.β¦
π¨ **Priority**: **CRITICAL**. β‘ **Urgency**: **IMMEDIATE ACTION REQUIRED**. Since it is unauthenticated RCE, automated bots are likely scanning for it. Patch or isolate immediately to prevent compromise. πββοΈπ¨