CVE-2025-69985: Fuxa Auth Bypass to RCE Vulnerability

CVE-2025-69985 Overview

CVE-2025-69985 is a critical Authentication Bypass vulnerability in FUXA, an open-source web-based SCADA/HMI platform, that enables Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host, subsequently gaining access to the protected /api/runscript endpoint to execute arbitrary Node.js code on the server.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on FUXA servers by spoofing a single HTTP header, potentially compromising industrial control system environments.

Affected Products

• Frangoteam FUXA version 1.2.8 and prior
• All FUXA installations using the vulnerable jwt-helper.js middleware
• Self-hosted and containerized FUXA deployments

Discovery Timeline

• 2026-02-24 - CVE-2025-69985 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2025-69985

Vulnerability Analysis

This vulnerability stems from a fundamental flaw in how FUXA implements authentication checks for API endpoints. The jwt-helper.js middleware is designed to protect sensitive API routes by requiring valid JWT tokens. However, the middleware contains a bypass condition that trusts the HTTP Referer header to identify "internal" requests that should be allowed without authentication.

When a request's Referer header matches the server's own hostname, the middleware assumes the request originated from the application's frontend and skips JWT validation entirely. This design flaw allows any remote attacker to simply set the Referer header to the target server's address, completely bypassing authentication controls.

The most critical impact of this bypass is access to the /api/runscript endpoint, which is designed to execute Node.js scripts on the server. With authentication bypassed, an attacker gains the ability to run arbitrary code with the privileges of the FUXA server process, leading to full system compromise.

Root Cause

The root cause is improper trust of client-supplied HTTP headers for security decisions (CWE-288: Authentication Bypass Using an Alternate Path or Channel). The Referer header is trivially spoofable by any attacker and should never be used as a security control. The jwt-helper.js middleware fails to recognize that HTTP headers can be arbitrarily set by malicious clients, creating a complete authentication bypass.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability remotely by crafting HTTP requests to the FUXA server with a spoofed Referer header matching the server's hostname. Once authentication is bypassed, the attacker sends a malicious payload to the /api/runscript endpoint to execute arbitrary Node.js code.

The exploitation flow involves: (1) identifying a vulnerable FUXA instance, (2) crafting an HTTP request with the Referer header set to the target server's URL, (3) sending a POST request to /api/runscript with malicious JavaScript code, and (4) achieving code execution with server privileges. A proof-of-concept demonstrating this attack chain is available in the GitHub Gist PoC.

Detection Methods for CVE-2025-69985

Indicators of Compromise

• Unexpected requests to /api/runscript endpoint from external IP addresses
• HTTP requests with Referer headers matching the server hostname but originating from non-local sources
• Unusual Node.js process spawning or child processes created by the FUXA server
• Suspicious outbound network connections from the FUXA server process
• Unexplained modifications to server files or configurations

Detection Strategies

• Monitor access logs for requests to /api/runscript that lack proper authentication tokens
• Implement web application firewall (WAF) rules to detect Referer header spoofing attempts
• Deploy network intrusion detection systems (NIDS) to identify exploitation attempts targeting FUXA installations
• Review server process trees for unexpected child processes spawned by Node.js

Monitoring Recommendations

• Enable verbose logging for the FUXA application to capture all API requests
• Configure SIEM alerts for authentication bypass patterns and unusual script execution
• Monitor for lateral movement attempts originating from FUXA server systems
• Implement file integrity monitoring on critical FUXA server directories

How to Mitigate CVE-2025-69985

Immediate Actions Required

• Isolate vulnerable FUXA instances from untrusted networks immediately
• Implement network-level access controls to restrict access to FUXA servers to authorized IP addresses only
• Deploy a reverse proxy or WAF to enforce additional authentication checks before requests reach FUXA
• Review server logs for evidence of prior exploitation attempts
• Consider taking affected FUXA instances offline until a patch is applied

Patch Information

Organizations should monitor the FUXA GitHub repository for security updates addressing this vulnerability. The vulnerable code is located in the jwt-helper.js middleware. Until an official patch is released, implement the workarounds and compensating controls described below to reduce risk.

Workarounds

• Configure firewall rules to restrict access to FUXA servers to trusted internal networks only
• Implement an authenticating reverse proxy (nginx, Apache with auth module) in front of FUXA to enforce additional authentication
• Disable or restrict access to the /api/runscript endpoint if script execution functionality is not required
• Deploy runtime application self-protection (RASP) or web application firewall rules to block Referer spoofing attacks

# Example nginx configuration to add authentication layer
location /api/ {
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://localhost:1881;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}