CVE-2026-47717: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-47717 is an unauthenticated project data disclosure vulnerability in FUXA, an open-source web-based SCADA/HMI platform. The GET /api/project endpoint exposes sensitive project configuration data — including server-side scripts, device connections, HMI layouts, and alarm definitions — to unauthenticated (guest-context) requests, even when secureEnabled is set to true. It affects fuxa-server npm package version 1.3.0 and was published on May 26, 2026, with a patch released in version 1.3.1. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). The GET /api/project endpoint in server/api/projects/index.js uses the secureFnc middleware, which internally calls verifyToken in server/api/jwt-helper.js. When no token is provided, verifyToken auto-generates a valid guest JWT (lines 49–51: if (!token) { token = getGuestToken(); }), which is signed with the server's own secret and passes verification. The getProject handler then returns the full project data; while _filterProjectPermission (line 924 of server/runtime/project/index.js) filters some UI elements for non-admin users, it does not strip scripts, device configurations, alarms, or other sensitive data from the response (GitHub Advisory, FUXA Security Advisory).

Successful exploitation allows any unauthenticated network attacker to retrieve the full FUXA project configuration, including server-side script source code (with execution modes and permission levels), device communication endpoint details, complete HMI screen layouts in SVG format with variable-to-device-tag bindings, and alarm thresholds and notification settings. In industrial environments, this intelligence can be used to map the deployed OT/ICS architecture, identify critical devices and automation logic, and plan targeted downstream attacks against the operational system. There is no integrity or availability impact, but the confidentiality exposure is rated High (GitHub Advisory).

A public proof-of-concept is included in the GitHub advisory: a single unauthenticated curl request to GET /api/project on the default FUXA port (1881) is sufficient to retrieve the full project data with no credentials, token, or API key required. The vulnerability requires no user interaction and has low attack complexity, making it trivially exploitable by any network-accessible attacker. No evidence of in-the-wild exploitation, threat actor attribution, EPSS score, or CISA KEV listing is currently available (GitHub Advisory, FUXA Security Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances running version 1.3.0 using tools like Shodan (search for fuxa or port 1881) or by scanning internal networks.
2. Confirm target: Verify the FUXA web interface is accessible at http://<target>:1881 and that the instance is running fuxa-server v1.3.0.
3. Send unauthenticated request: Issue a plain HTTP GET request to the /api/project endpoint with no authentication headers, cookies, or tokens:

   curl -s http://<target>:1881/api/project

4. Receive full project data: The server auto-generates a guest JWT internally and returns the complete project JSON, including server-side script source code, device connection details, HMI SVG layouts with tag bindings, and alarm definitions.
5. Analyze and exploit: Use the retrieved configuration data to map the industrial system architecture, identify device communication protocols and endpoints, and plan targeted follow-on attacks against connected OT/ICS devices (GitHub Advisory, FUXA Security Advisory).

• Network: Unauthenticated HTTP GET requests to /api/project on port 1881 (or configured FUXA port) from external or unexpected IP addresses; absence of Authorization header in requests to this endpoint.
• Logs: FUXA access logs showing repeated or automated GET /api/project requests with no authentication token, particularly from unfamiliar source IPs or at unusual times.
• Behavioral: Bulk or scripted retrieval of the /api/project endpoint (e.g., high-frequency requests or requests from scanning tools like curl, wget, or automated scanners) (GitHub Advisory).

The FUXA maintainers released version 1.3.1, which addresses this vulnerability along with several other security fixes including authentication bypass in request routing logic and SQL injection issues. Users should upgrade fuxa-server from npm version 1.3.0 to 1.3.1 or later immediately. As a network-level workaround prior to patching, restrict access to the FUXA web interface (port 1881) using firewall rules or network segmentation to prevent unauthenticated external access (FUXA v1.3.1 Release, GitHub Advisory).