CRITICAL9.8

GHSA-r87q-fq37-pvr6

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA

Details

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@frangoteam/fuxa

Introduced in: 0

No fixed version published yet for @frangoteam/fuxa (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-33831[ADVISORY]
https://github.com/frangoteam/FUXA[PACKAGE]
https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831[WEB]
https://youtu.be/Xxa6yRB2Fpw[WEB]