GHSA-r87q-fq37-pvr6

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-33831

Packages

Ecosystem	Package	Affected	Fixed in
npm	@frangoteam/fuxa	<= 1.1.13	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-33831 advisory
https://github.com/frangoteam/FUXA package
https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831 web
https://youtu.be/Xxa6yRB2Fpw web