Executive brief
FUXA is an open-source industrial automation and SCADA visualization platform used to monitor and control manufacturing operations. The /api/download endpoint contains a path traversal flaw that allows an attacker to read arbitrary files from the server without authentication, potentially exposing sensitive configuration files, credentials, and operational data.
Technical details
FUXA versions up to 1.1.12 contain a local file inclusion (LFI) vulnerability in the /api/download endpoint (CWE-98). The "name" parameter does not properly sanitize path traversal sequences (../, etc.), allowing an unauthenticated remote attacker to read arbitrary files from the server using a specially crafted request like /api/download?cmd=REPORT-DOWNLOAD&name=../../../../../../etc/passwd. No authentication is required and the attack is trivial to execute from the network. Successful exploitation allows an attacker to disclose sensitive files including system configuration, credentials, and application source code.
Affected products
- FUXA FUXA Server <=1.1.12
Timeline
- 2023-09-22: disclosed