Description
FUXA 是一款基于 Web 的流程可视化（SCADA/HMI/仪表盘）软件。FUXA /api/logs 端点用于从 FUXA 下载报告，攻击者可读取任意本地文件。
FUXA logs /api/logs 文件读取漏洞（CVE-2023-31716）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-31716
https://github.com/MateusTesser/CVE-2023-31716
https://cve.imfht.com/detail/CVE-2023-31716
https://www.miggo.io/vulnerability-database/cve/CVE-2023-31716
https://security.snyk.io/vuln/SNYK-JS-FRANGOTEAMFUXA-5915274
https://www.cve.org/CVERecord?id=CVE-2023-31716
https://advisories.gitlab.com/npm/@frangoteam/fuxa/CVE-2023-31716/
https://www.acunetix.com/vulnerabilities/sca/cve-2023-31716-vulnerability-in-npm-package-frangoteam-fuxa/