FUXA < 1.2.8 - Unauthenticated Authentication Bypass and Remote Code Execution via Referer Header Spoofing
Title source: llmExploitation Summary
CVE-2025-69985 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 7 public exploits from researchers including joshua, Professor-Archbishop, exploitintel.
AI-analyzed exploit summary This Python exploit demonstrates an authentication bypass and remote code execution (RCE) vulnerability in FUXA ≤ 1.2.8 by sending a crafted JavaScript payload to the /api/runscript endpoint, achieving command execution with stdout capture.
Description
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
Exploits (7)
This Python exploit demonstrates an authentication bypass and remote code execution (RCE) vulnerability in FUXA ≤ 1.2.8 by sending a crafted JavaScript payload to the /api/runscript endpoint, achieving command execution with stdout capture.
This repository contains a functional Python exploit for CVE-2025-69985, an authentication bypass and RCE vulnerability in FUXA ≤ 1.2.8. The exploit leverages a flawed Referer header check to bypass JWT authentication and execute arbitrary Node.js code via the /api/runscript endpoint.
The repository contains functional exploit code demonstrating an authentication bypass vulnerability in FUXA SCADA, leading to unauthenticated remote code execution via spoofed HTTP Referer headers and arbitrary JavaScript execution through the /api/runscript endpoint.
This repository contains a functional Python exploit for CVE-2025-69985, targeting an authentication bypass and RCE vulnerability in FUXA ≤ 1.2.8. The exploit crafts a JavaScript payload to execute arbitrary commands via the /api/runscript endpoint.
The repository contains a functional Python exploit for CVE-2025-69985, targeting FUXA Professional ≤1.2.8. It bypasses authentication via Referer header manipulation and achieves RCE through the /api/runscript endpoint.
This repository contains a functional Python exploit for CVE-2025-69985, an authentication bypass and RCE vulnerability in FUXA ≤ 1.2.8. The exploit leverages a spoofed Referer header to bypass JWT authentication and execute arbitrary Node.js code via the /api/runscript endpoint.
This repository contains a functional Python exploit for CVE-2025-69985, targeting an authentication bypass and RCE vulnerability in FUXA ≤ 1.2.8. The exploit crafts a JavaScript payload to execute arbitrary commands via the /api/runscript endpoint.
References (2)
Related Analysis
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
