This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Roxy-WI suffers from **OS Command Injection**. Attackers can execute arbitrary system commands remotely via the `subprocess_execute` function.β¦
π‘οΈ **Root Cause**: **CWE-78** (OS Command Injection). The flaw lies in `/app/options.py`, where user inputs are not sanitized before being passed to the command execution function.β¦
π¦ **Affected**: **Roxy-WI** versions **before 6.1.1.0**. π’ **Vendor**: hap-wi. π **Component**: The web interface managing Haproxy, Nginx, and Keepalived servers.
Q4What can hackers do? (Privileges/Data)
π **Hackers Can**: Execute commands with the privileges of the Roxy-WI service account. π **Impact**: Read/Write/Modify any file, steal data, install backdoors, or pivot to other internal servers.β¦
π **Threshold**: **LOW**. π **Access**: Network Accessible (AV:N). π **Auth**: No Privileges Required (PR:N). π€ **UI**: No User Interaction Needed (UI:N). It is a critical, easy-to-exploit flaw.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exp**: **YES**. π **PoCs**: Available on GitHub (Threekiii/Awesome-POC) and Nuclei templates. π **Wild Exploitation**: Likely, given the low barrier to entry and public availability of exploits.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for Roxy-WI instances. π§ͺ **Test**: Use Nuclei template `CVE-2022-31137.yaml`. π **Verify**: Check if `/app/options.py` is vulnerable to command injection via `subprocess_execute`.
Q8Is it fixed officially? (Patch/Mitigation)
π οΈ **Fixed**: **YES**. β **Patch**: Upgrade to **Roxy-WI version 6.1.1.0** or later. π’ **Advisory**: See GHSA-53r2-mq99-f532 for official details.
Q9What if no patch? (Workaround)
π§ **No Patch?**: Implement strict **Input Validation** on `/app/options.py`. π« **Mitigation**: Restrict network access to Roxy-WI. π **Defense**: Use WAF rules to block OS command injection patterns in HTTP requests.
Q10Is it urgent? (Priority Suggestion)
π¨ **Urgency**: **CRITICAL**. π΄ **Priority**: **P0**. Immediate patching required. With CVSS High and public PoCs, active exploitation is highly probable. Do not delay! β³