Description

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

Remediation

References

https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831

https://youtu.be/Xxa6yRB2Fpw

Related Vulnerabilities

CVE-2021-44228 Vulnerability in maven package org.apache.logging.log4j:log4j-core

CVE-2022-24697 Vulnerability in maven package org.apache.kylin:kylin-core-common

CVE-2010-2103 Vulnerability in maven package org.apache.axis2:axis2

CVE-2018-20227 Vulnerability in maven package org.eclipse.rdf4j:rdf4j-util

CVE-2019-20174 Vulnerability in npm package auth0-lock

Severity

Critical

Classification

CWE-77 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory