Executive brief
FUXA is a web-based SCADA/HMI dashboard software used to visualize and control industrial processes. A server-side request forgery (SSRF) vulnerability allows attackers to make the server perform unauthorized requests to internal systems and services, potentially exposing sensitive configuration data and enabling further attacks on the underlying infrastructure.
Technical details
The vulnerability is a classic Server-Side Request Forgery (CWE-918) present in FUXA 1.1.3 and earlier. The affected component fails to properly validate or restrict outbound requests made by the server, allowing an unauthenticated network attacker to craft malicious input that causes the server to initiate requests to internal resources and services. An attacker can exploit this to access metadata services, internal APIs, and local services running on the affected host or network, potentially leading to information disclosure and command execution. The vulnerability requires network access but no authentication or user interaction.
Affected products
- FUXA FUXA 1.1.3 and earlier
Timeline
- 2022-03-16: disclosed
- 2022-03-17: advisory