PT-2022-3949 · Nginx+4 · Nginx+4

Aidaho12 + 1 · Published 2022-07-08 · Updated 2025-05-26 · CVE-2022-31137

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 6.1.1.0

Description Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The issue arises from the subprocess execute function in the /app/options.py file, which does not properly process user input, allowing system commands to be executed remotely without authentication. This enables attackers to run arbitrary code on the system.

Recommendations For versions prior to 6.1.1.0, it is recommended to upgrade to a newer version to resolve the issue. As a temporary workaround, consider restricting access to the subprocess execute function in the /app/options.py file until a patch is available. Additionally, avoid using the subprocess execute function without proper input validation to minimize the risk of exploitation. At the moment, there is no information about other mitigation measures for this vulnerability.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-04779

CVE-2022-31137

GHSA-53R2-MQ99-F532

Affected Products

Apache

Haproxy

Keepalived

Nginx

Roxy-Wi

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/roxy_wi_exec.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31137.json · Exploit
• 🔥 http://packetstormsecurity.com/files/167805/Roxy-WI-Remote-Command-Execution.html · Exploit
• https://github.com/hap-wi/roxy-wi/commit/82666df1e60c45dd6aa533b01a392f015d32f755 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31137 · Security Note
• https://bdu.fstec.ru/vul/2022-04779 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31137 · Vendor Advisory
• https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-53r2-mq99-f532 · Note
• https://t.me/true_secator/6680 · Telegram Post
• http://packetstormsecurity.com/files/172547/Roxy-WI-6.1.0.0-Remote-Command-Execution.html · Note
• https://twitter.com/pdnuclei_bot/status/1926880664856531152 · Twitter Post
• https://t.me/defcon_news/102022 · Telegram Post
• https://t.me/cvenotify/47454 · Telegram Post
• http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html · Note
• http://packetstormsecurity.com/files/171648/Roxy-WI-6.1.0.0-Improper-Authentication-Control.html · Note