N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-32cc-x95p-fxcg

GHSA-32cc-x95p-fxcg: FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

Description

An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.

Impact

The FUXA documentation allows administrators to manually update a hardcoded JWT secret when enabling authentication. This feature was not available in the UI. This results in a fail-open security posture, where the application can report or appear to be operating in secureEnabled mode while still accepting tokens signed with a publicly known key.

Exploitation allows an unauthenticated, remote attacker to forge JWTs to bypass all authentication mechanisms and obtain administrative access to the FUXA instance. With these elevated privileges, the attacker can interact with administrative APIs, including intended features designed for automation and scripting, to execute arbitrary code in the context of the FUXA service. Depending on deployment configuration and permissions, this may lead to full system compromise and could further expose connected ICS/SCADA environments to follow-on actions.

Patches

This issue has been patched in FUXA version 1.2.10. Users are strongly encouraged to update to the latest available release.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-32cc-x95p-fxcg

GHSA-32cc-x95p-fxcg:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fuxa-server	npm	<= 1.2.9	1.2.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2023-41904, is an unauthenticated remote code execution flaw in FUXA caused by a hardcoded JWT secret. When authentication is enabled without a user-configured secret, the application defaults to a publicly known hardcoded secret. This allows an attacker to forge JWT tokens, gain administrative privileges, and execute arbitrary code.

The analysis of the patch commit ea7b3df066f9fdef8ecdce318398ae40546bc50d reveals the mitigation strategy. The patch introduces a new secretCode setting that can be configured through the UI and API. The core of the fix lies in modifying the server-side logic to handle this new setting.

The identified functions are central to the fix. The startup script in server/main.js is modified to read the secretCode from the settings file. The init and mergeUserSettings functions in server/api/index.js are updated to process and apply the secretCode when settings are changed via the API. These changes ensure that a user-provided secret is used for signing and verifying JWTs, rather than the hardcoded default.

Therefore, the functions that were modified to read, process, and apply the secretCode are the ones that address the vulnerability. An attacker would exploit the absence of this logic in older versions to bypass authentication. During exploitation on a vulnerable version, the JWT verification function (likely in the authJwt module) would be in the call stack, using the hardcoded secret. The patched functions are the ones that prevent this from happening by allowing the secret to be changed.

Vulnerable functions

init

server/api/index.js

This function is responsible for initializing the API endpoints. The patch modifies the settings endpoint handler within this function to re-initialize the authentication modules (`authJwt` and `authApi`) when security settings, including the new `secretCode`, are changed. The vulnerability stemmed from the authentication system using a hardcoded secret, and this change is part of the fix to allow a user-defined secret to be applied.

mergeUserSettings

server/api/index.js

This function merges new settings into the application's runtime configuration. Before the patch, it did not process the `secretCode`, meaning that even if a new secret was provided, it would not be applied to the running application. The patch adds the logic to update the `secretCode` in the runtime settings, which is a crucial step in mitigating the hardcoded secret vulnerability.

(anonymous function)

server/main.js

This code is from the main entrypoint of the server application, which runs at startup. It reads settings from a file and applies them. The vulnerability was caused by the application not reading a `secretCode` from the settings file, forcing it to rely on a hardcoded default. The patch adds logic to read the `secretCode` from the settings file, allowing it to be configured and persisted, thus fixing the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-32cc-x95p-fxcg: FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

Description

Impact

Patches

GHSA-32cc-x95p-fxcg:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

GHSA-32cc-x95p-fxcg: FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

Description

Impact

Patches

Basic Information

Basic Information

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI