PT-2022-12437 · Fuxa · Fuxa

Published 2022-03-16 · Updated 2022-03-23 · CVE-2021-45851

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FUXA version 1.1.3

Description A Server-Side Request Forgery (SSRF) attack can be carried out, leading to the obtaining of sensitive information from the server's internal environment and services. This could potentially allow the attacker to execute commands on the server.

Recommendations For FUXA version 1.1.3, as a temporary workaround, consider restricting access to sensitive internal services to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-45851

GHSA-9VP3-7QWQ-83R9

Affected Products

Fuxa

References · 6

• 🔥 https://youtube.com/watch?v=JE1Kcq3iJpc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45851 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45851 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9vp3-7qwq-83r9 · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://t.me/cibsecurity/39014 · Telegram Post