T3MP3ST v1 — hardened launch (AGPL, verify-claims 24/24, leak-scrubbed)

bench/cve-zero/results/hunt-GHSA-rg3m-cfq7-g6h6.json

@@ -1 +1 @@
-{"id": "GHSA-rg3m-cfq7-g6h6", "cve": "CVE-2026-43947", "repo": "frangoteam/FUXA", "cwes": ["CWE-863"], "vuln_files": ["server/api/command/index.js", "server/integrations/node-red/index.js"], "duration_sec": 102.9, "error": null, "strict": true, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "Node-RED admin auth bypass via unanchored URL substring match (\"/dashboard\") leading to RCE", "file": "server/integrations/node-red/index.js", "line": 160, "cwe": "CWE-287"}, {"fileMatch": true, "lineProx": false, "cweMatch": true, "hit": true, "title": "Node-RED SPA catch-all serves index from settings.httpStatic without sanitization (low)", "file": "server/integrations/node-red/index.js", "line": 280, "cwe": "CWE-285"}], "n_findings": 2, "findings": [{"title": "Node-RED admin auth bypass via unanchored URL substring match (\"/dashboard\") leading to RCE", "file": "server/integrations/node-red/index.js", "line": 160, "cwe": "CWE-287", "vuln_class": "auth-bypass", "severity": "critical", "description": "The allowDashboard middleware (mounted on app.use('/nodered', allowDashboard, RED.httpAdmin)) is the only authentication gate for the Node-RED admin/editor API; no adminAuth is configured in redSettings. At line 157 it builds url = req.originalUrl, which in Express includes the mount path AND the raw query string. Line 160 then grants public access with `if (url.includes('/dashboard') || url.includes('/socket.io')) return next();`. Because this is an unanchored substring test on the full URL+query, any request to a protected admin route that merely contains the substring '/dashboard' (or 'dashboard') anywhere\u2014including inside the query string\u2014short-circuits before the JWT / x-api-key validation, even when settings.secureEnabled is true. An unauthenticated attacker can therefore reach the full Node-RED admin REST API. Via POST /nodered/flows they can deploy a flow containing a Function node, which (with the broad functionGlobalContext exposing fs, fsSync, os, child_process when enabled, plus the FUXA runtime helpers like runScript/setTag) yields arbitrary file read/write and remote code execution on the FUXA host.", "poc": "1) Read flows unauthenticated: GET /nodered/flows?x=/dashboard HTTP/1.1  (url.includes('/dashboard') is true -> next() without token). 2) Deploy malicious flow unauthenticated: POST /nodered/flows?x=/dashboard with header 'Content-Type: application/json' and a flow array containing an inject node wired to a function node whose body uses the exposed global context, e.g. node 'func': {\"func\":\"const cp=global.get('child_process')||require('child_process'); cp.exec('id > /tmp/pwned'); return msg;\"} (or use fsSync to write a webshell). The deploy is accepted because authentication was bypassed, resulting in RCE.", "confidence": 0.9}, {"title": "Node-RED SPA catch-all serves index from settings.httpStatic without sanitization (low)", "file": "server/integrations/node-red/index.js", "line": 280, "cwe": "CWE-285", "vuln_class": "info-disclosure", "severity": "low", "description": "The same substring-based reasoning applies to the catch-all and exclusion logic using req.path.startsWith/includes; while less severe, the auth model around /nodered relies on fragile string matching. Secondary to the primary auth-bypass finding.", "poc": "GET /nodered/something?dashboard also bypasses the gate due to the same includes() check.", "confidence": 0.4}], "transcript": ""}
+{"id": "GHSA-rg3m-cfq7-g6h6", "cve": "CVE-2026-43947", "repo": "frangoteam/FUXA", "cwes": ["CWE-863"], "vuln_files": ["server/api/command/index.js", "server/integrations/node-red/index.js"], "duration_sec": 48.5, "error": null, "strict": true, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "Node-RED admin editor auth bypass via substring URL match (leads to RCE)", "file": "server/integrations/node-red/index.js", "line": 160, "cwe": "CWE-287"}, {"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "getTagValue authorization can be bypassed via attacker-supplied sourceScriptName", "file": "server/api/command/index.js", "line": 80, "cwe": "CWE-639"}], "n_findings": 2, "findings": [{"title": "Node-RED admin editor auth bypass via substring URL match (leads to RCE)", "file": "server/integrations/node-red/index.js", "line": 160, "cwe": "CWE-287", "vuln_class": "auth-bypass", "severity": "critical", "description": "The `allowDashboard` middleware is the only authentication guard mounted in front of the Node-RED admin/editor API (`app.use('/nodered', allowDashboard, RED.httpAdmin)`). It builds `url = req.originalUrl || req.url || req.path` (which INCLUDES the query string) and then bypasses all authentication with `if (url.includes('/dashboard') || url.includes('/socket.io')) return next();`. Because `.includes()` is an unanchored substring match against the full URL (including the attacker-controlled query string), any request to the protected admin API can be made to satisfy the check simply by putting the literal string `/dashboard` (or `/socket.io`) anywhere in the query string. The intended prefix check (the public HTTP-node dashboard is served under httpNodeRoot `/dashboard`) is therefore trivially defeated, granting unauthenticated access to the Node-RED admin/editor endpoints under `/nodered`. Node-RED's admin API allows deploying flows containing `function` nodes that execute arbitrary JavaScript; combined with the exposed `functionGlobalContext` (fs, os, http, and optionally child_process, plus the FUXA `runtime`), this results in remote code execution / full server compromise. No JWT or API-key check is reached on the bypassed path.", "poc": "Unauthenticated attacker (secureEnabled=true, default auth mode) requests the Node-RED admin API with a query string containing the magic substring, e.g.:\n\n  GET /nodered/settings?x=/dashboard  HTTP/1.1\n\nor deploy a malicious flow:\n\n  POST /nodered/flows?redirect=/dashboard HTTP/1.1\n  Content-Type: application/json\n  Node-RED-Deployment-Type: full\n  [ {\"id\":\"1\",\"type\":\"tab\"}, {\"id\":\"2\",\"type\":\"inject\",\"z\":\"1\",\"props\":[{\"p\":\"payload\"}],\"once\":true,\"wires\":[[\"3\"]]}, {\"id\":\"3\",\"type\":\"function\",\"z\":\"1\",\"func\":\"require('child_process').exec('id > /tmp/pwned'); return msg;\",\"wires\":[[]]} ]\n\nThe `url.includes('/dashboard')` check passes, `next()` is called, the request hits RED.httpAdmin without any token validation, and the deployed function node executes attacker code on the server.", "confidence": 0.9}, {"title": "getTagValue authorization can be bypassed via attacker-supplied sourceScriptName", "file": "server/api/command/index.js", "line": 80, "cwe": "CWE-639", "vuln_class": "auth-bypass", "severity": "medium", "description": "The /api/getTagValue endpoint grants access if `runtime.scriptsMgr.isAuthorisedByScriptName(req.query.sourceScriptName, permission)` returns true. The script name is fully attacker-controlled via the query string, so a non-admin user can attempt to supply the name of any privileged script to satisfy the authorization check and read tag values they should not be able to access (info disclosure of process/SCADA tag values).", "poc": "GET /api/getTagValue?ids=[\"tag1\"]&sourceScriptName=<name-of-authorized-script> with a low-privilege token.", "confidence": 0.4}], "transcript": ""}