Executive brief
FUXA is web-based industrial automation software used for process visualization, SCADA systems, and dashboards in critical infrastructure and manufacturing environments. An unauthenticated attacker can execute arbitrary commands on the server by sending a crafted request to the /api/runscript endpoint, potentially gaining complete control of the system and accessing sensitive operational data.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-94) in the /api/runscript endpoint that fails to properly sanitize user input before executing system commands. An attacker can send a malicious POST request without authentication to inject and execute arbitrary shell commands with the privileges of the FUXA process. The attack vector is network-based with no authentication or user interaction required. Successful exploitation allows complete remote command execution, enabling an attacker to compromise the entire system. The vulnerability affects FUXA version 1.1.13 and all previous versions.
Affected products
- Frango Team FUXA 1.1.13 and all previous versions
Timeline
- 2023-09-18: disclosed: Advisory published