FUXA versions before 1.3.2 contain an SSRF vulnerability due to missing authorization checks (isSocketWriteAuthorized) in DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers. Attackers can supply arbitrary property.address or endpoint data, causing server/runtime/devices/httprequest/index.js to invoke axios.get on attacker-controlled URLs. This allows remote unauthenticated attackers to access internal HTTP/HTTPS services, OPC UA, and ODBC endpoints reachable from the FUXA server, potentially disclosing sensitive information. The issue is resolved in version 1.3.2.

An unauthenticated remote attacker can exploit this SSRF vulnerability to cause the FUXA server to make arbitrary HTTP or HTTPS requests, potentially exposing sensitive internal resources such as cloud instance metadata, internal administrative services, industrial control endpoints, and ODBC data. This can lead to information disclosure (high confidentiality impact) but does not directly affect integrity or availability.

Upgrade FUXA to version 1.3.2 or later, where the vulnerability is fixed by adding proper authorization checks to the affected Socket.IO handlers. No other mitigation is required as the fix is official and complete.