CVE-2026-47719: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47719 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in FUXA, an open-source web-based SCADA/HMI platform. It affects all versions of the fuxa-server npm package up to and including 1.3.1, and was discovered by aisafe.io, published on May 29, 2026, and added to the GitHub Advisory Database on June 8, 2026. The vulnerability allows any unauthenticated attacker to abuse FUXA's Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY event handlers to make arbitrary server-side HTTP requests and receive full response bodies. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, FUXA Advisory).

The root cause is a missing authorization check (CWE-918) in two Socket.IO event handlers in server/runtime/index.js. The DEVICE_WEBAPI_REQUEST handler (lines 296–316) accepts a message.property.address field from any connected client and passes it directly to axios.get(address) in server/runtime/devices/httprequest/index.js:471, then broadcasts the full HTTP response body to all connected clients via io.emit. The DEVICE_PROPERTY handler (lines 153–171) similarly accepts attacker-controlled endpoint parameters and forwards them to OPC UA and ODBC device drivers without validation. Both handlers omit the isSocketWriteAuthorized(socket) check that protects comparable write-capable events (DEVICE_VALUES at line 182, DEVICE_ENABLE at line 358). Critically, even with secureEnabled=true, the Socket.IO connect block auto-issues a guest token to any unauthenticated client, meaning authentication mode does not mitigate the flaw (FUXA Advisory, GitHub Advisory).

An unauthenticated remote attacker can use FUXA as an SSRF oracle to probe and exfiltrate data from any HTTP(S) service reachable by the FUXA host, including cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) to steal IAM credentials. On OT/ICS networks, the attacker can reach internal OPC UA servers, ODBC databases, and administrative consoles with no other external exposure. The ODBC variant additionally allows the attacker to supply arbitrary credentials and authenticate to any ODBC server that trusts connections from the FUXA host. Furthermore, because responses are broadcast via io.emit rather than scoped to the requesting socket, response data is exposed to all currently connected Socket.IO clients (FUXA Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory date. The vulnerability requires no authentication, no user interaction, and no special preconditions beyond network access to the FUXA Socket.IO port, making it trivially exploitable. The EPSS score is approximately 0.084–0.101% (28th percentile), indicating low but non-negligible exploitation probability in the near term. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances (versions ≤ 1.3.1) using tools like Shodan or Censys, searching for the FUXA web interface or Socket.IO endpoint (typically on port 1881).
2. Connect to Socket.IO: Establish a Socket.IO connection to the FUXA server endpoint (e.g., http://<target>:1881/socket.io/). No credentials are required; the server auto-issues a guest token.
3. Emit DEVICE_WEBAPI_REQUEST event: Send a crafted Socket.IO event targeting the DEVICE_WEBAPI_REQUEST event type with a malicious property.address value, such as the AWS metadata endpoint: socket.emit('device-webapi-request', { property: { method: 'GET', address: 'http://169.254.169.254/latest/meta-data/iam/security-credentials/' } }).
4. Receive SSRF response: Listen for the device-webapi-request event broadcast by the server; the full HTTP response body (e.g., IAM role names or credentials) is returned to all connected clients via io.emit.
5. Pivot via DEVICE_PROPERTY: Alternatively, emit a DEVICE_PROPERTY event with a crafted endpoint pointing to an internal OPC UA server or ODBC database, supplying attacker-controlled credentials to authenticate and extract data from those systems.
6. Internal network scanning: Iterate over internal IP ranges and ports using the SSRF primitive to map internal services not otherwise externally accessible (FUXA Advisory, GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the FUXA server process to cloud metadata IPs (e.g., 169.254.169.254, fd00:ec2::254), internal RFC-1918 addresses, or unusual external hosts; Socket.IO connections from unknown or external IP addresses to the FUXA port (default 1881).
• Logs: FUXA server logs showing device-webapi-request or DEVICE_PROPERTY Socket.IO events originating from unauthenticated or guest sessions; repeated requests to the same handler from a single IP in a short timeframe (indicative of scanning).
• Process: Unexpected outbound network connections initiated by the Node.js/FUXA process (e.g., node process making connections to 169.254.169.254 or internal subnets); axios HTTP client activity to non-configured device addresses.
• Application: io.emit broadcasts of device-webapi-request or DEVICE_PROPERTY events containing response bodies from internal or metadata services visible to all connected Socket.IO clients.

The vendor has released FUXA v1.3.2, which addresses this vulnerability by adding isSocketWriteAuthorized(socket) checks to both the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY handlers, scoping responses to the requesting socket via socket.emit instead of io.emit, and adding path normalization in API routing (FUXA v1.3.2 Release). Users should upgrade to v1.3.2 or later immediately. As a defense-in-depth measure, restrict network access to the FUXA Socket.IO port (default 1881) to trusted hosts only, and implement egress filtering on the FUXA host to block outbound connections to cloud metadata services and internal network ranges not required for legitimate device communication (FUXA Advisory).

The vulnerability was discovered and reported by aisafe.io, credited in the advisory. The fix was incorporated into FUXA v1.3.2 released on May 19, 2026, prior to the advisory's public disclosure on May 29, 2026, indicating responsible disclosure coordination. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (GitHub Advisory, FUXA v1.3.2 Release).