Frangoteam Fuxa: Remote Command Execution via /api/runscript (CVE-2023-33831)

Frangoteam Fuxa version 1.1.13 is susceptible to unauthenticated Remote Command Execution (RCE). An attacker can trigger this vulnerability by sending a crafted HTTP POST request to the '/api/runscript' endpoint. The 'code' parameter within the request body is not properly sanitized, allowing for arbitrary command execution on the underlying server. Publicly available exploit code and proof-of-concept (PoC) material have been released, elevating the risk of exploitation.

Impact

Successful exploitation results in full remote command execution with the privileges of the Fuxa application process, allowing an attacker to achieve total system compromise, including data exfiltration, lateral movement, and system disruption.

Recommendation

• Identify all instances of Frangoteam Fuxa version 1.1.13 within the environment.
• Implement a web application firewall (WAF) rule to block or inspect HTTP POST requests targeting the '/api/runscript' endpoint containing suspicious payloads in the 'code' parameter.
• Monitor server-side logs and network traffic for outbound connections from the application server, particularly those directed toward non-standard ports such as 1881, which are commonly utilized in the public PoC.
• Upgrade to a patched version of Fuxa immediately if one is available.