FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

Summary

The GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled.

Details

File: server/api/projects/index.js

prjApp.get("/api/project", secureFnc, function(req, res) {
    const permission = checkGroupsFnc(req);
    runtime.project.getProject(req.userId, permission).then(result => {
        if (result) {
            res.json(result);
        }
    });
});

The endpoint uses the secureFnc middleware, but this middleware calls verifyToken in server/api/jwt-helper.js which auto-generates a valid guest JWT when no token is provided (line 49-51):

if (!token) {
    token = getGuestToken();
}

The guest token is signed with the server's secret and passes verification. The handler then calls getProject which returns the full project data. The _filterProjectPermission function (line 924 of server/runtime/project/index.js) filters some UI elements for non-admin users, but it does not remove scripts, devices, alarms, or other sensitive configuration data.

PoC

Environment

• FUXA v1.3.0-2773 (frangoteam/fuxa:latest)
• secureEnabled: true with a random secretCode

Retrieve full project data without authentication:

curl -s http://192.168.32.129:1881/api/project

{
  "scripts": [
    {
      "id": "SCRIPT_ID",
      "name": "calculate"
    },
  ]
}

No authentication token, API key, or cookie was provided. The response includes:

• Server-side scripts: full source code, IDs, names, execution mode, and permission levels. This reveals internal automation logic and sensitive project structure information that could assist further attacks against the deployed system.
• Device configurations: and communication endpoint information may also be exposed depending on the deployed project configuration.