Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability in FUXA, a web-based industrial control system software, allows unauthenticated remote attackers to gain unauthorized access to sensitive system controls. The issue stems from a flaw in how access is authorized, potentially enabling attackers to deploy malicious scripts, alter project data, or even execute operating system commands.
- Unauthorized access to industrial control software.
- Critical controls could be manipulated by attackers.
- Confirm relevance and ensure exposure is understood.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by first obtaining a signed guest token from the `/api/heartbeat` endpoint. This token can then be used to access the Node-RED editor and API. With this access, the attacker can deploy malicious function nodes or execute scripts, potentially leading to the compromise of FUXA project data, configuration, and even operating system commands.
- Unauthenticated network access to API.
- Deploy function nodes or execute scripts.
- Gain control of project data and system.
Live Threat
Current exploitation, exposure, and threat context
A remote, unauthenticated attacker could leverage this vulnerability to access the Node-RED editor and deployment API when specific security configurations are enabled. This could allow them to deploy function nodes or execute scripts, potentially affecting FUXA project data, configurations, and scripts. In scenarios where Node-RED modules are configured for unsafe operations, this could extend to executing operating-system commands.
- FUXA project data and configurations.
- Exploiting an authorization bypass.
- Compromise of FUXA project control.
Operational Fix
Recommended remediation, mitigation, and detection steps
System owners responsible for industrial control systems and SCADA/HMI environments should lead the response to this vulnerability. The first practical step is to identify all FUXA instances, determine their network exposure and business criticality, and locate the accountable application or system owner. Subsequently, remediation efforts can be planned based on the identified risk, which may involve vendor coordination for updates or implementing temporary risk-reduction measures if immediate patching is not feasible.
- Identify FUXA instances and owners.
- Verify network exposure and criticality.
- Plan remediation based on risk.
