Executive brief
FUXA is a web-based process visualization and SCADA dashboard software used to monitor and control industrial systems. A flaw in versions 1.3.2 and earlier allows an authenticated user with non-admin runtime access to exploit a server-side request forgery (SSRF) vulnerability, potentially enabling the attacker to read responses from internal services or cloud metadata endpoints that the FUXA server can reach. This could expose sensitive internal configuration, credentials, or infrastructure details depending on the deployment environment.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the device-webapi-request Socket.IO handler located in server/runtime/index.js. An authenticated non-admin runtime user can manipulate the property.address parameter to cause the FUXA server to issue arbitrary outbound HTTP or HTTPS requests and return the response body to the attacker. The attack requires authentication (user login) and network access to the Socket.IO interface, but does not require admin privileges. An attacker can use this to read responses from internal services (databases, cloud metadata endpoints like AWS EC2 IMDSv1, internal APIs) that are reachable from the FUXA host. The vulnerability is patched in version 1.3.3.
Affected products
- FUXA FUXA 1.3.2 and earlier
Timeline
- 2026-08-18: disclosed
- 2026-05-25: patched: Fix merged in version 1.3.3