N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2r8f-cf6w-x5vq

GHSA-2r8f-cf6w-x5vq: Duplicate Advisory: FUXA contains a hard-coded credential vulnerability

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-c8m8-3jcr-6rj5. This link is maintained to preserve external references.

Original Description

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2r8f-cf6w-x5vq

GHSA-2r8f-cf6w-x5vq:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fuxa-server	npm	<= 1.2.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described in the advisory for FUXA <= 1.2.7, is a hard-coded secret in server/api/jwt-helper.js. This secret is used for signing and verifying JWT tokens. The core of the vulnerability is that anyone with access to the source code can find this secret and use it to forge JWT tokens with any claims they want, for example, granting themselves administrative privileges.

The functions verify, verifyToken, and requireAuth are directly responsible for verifying incoming JWTs. During an attack, a forged token would be passed to one of these functions, which would then incorrectly validate it because the token is signed with the known, hard-coded secret. Therefore, these functions would appear in a runtime profile during exploitation.

The init function is also critical as it is responsible for setting the secret. While the provided code from the master branch shows a randomly generated secret as a fallback, the vulnerability in version 1.2.7 implies that this was not the case, and a static, predictable secret was used. The functions getNewTokenFromRequest and getGuestToken also use the secret for signing, but the primary exploitation vector is through the verification functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.