hap-wi · roxy-wi
An unauthenticated remote code execution flaw in the Roxy-WI web interface for managing Haproxy, Nginx, Apache and Keepalived servers, located in the subprocess_execute function in /app/options.py, which runs system commands without sanitising user-supplied input. A remote attacker needs only network access to the interface, with no credentials and no user interaction, to run arbitrary system commands; the affected versions are those prior to 6.1.1.0, and there are no known workarounds, so upgrading is the only remedy.
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
First seen exploited 5 months after disclosure. Public exploit code (Metasploit) was available 2 days before disclosure.
No high- or medium-confidence techniques. The 1 available link are lower confidence and listed below.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
Reports are matched by finding the exact id CVE-2022-31137 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.