This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Roxy-WI suffers from **OS Command Injection**. Attackers can execute arbitrary system commands remotely via the `subprocess_execute` function.โฆ
๐ก๏ธ **Root Cause**: **CWE-78** (OS Command Injection). The flaw lies in `/app/options.py`, where user inputs are not sanitized before being passed to the command execution function.โฆ
๐ฆ **Affected**: **Roxy-WI** versions **before 6.1.1.0**. ๐ข **Vendor**: hap-wi. ๐ **Component**: The web interface managing Haproxy, Nginx, and Keepalived servers.
Q4What can hackers do? (Privileges/Data)
๐ **Hackers Can**: Execute commands with the privileges of the Roxy-WI service account. ๐ **Impact**: Read/Write/Modify any file, steal data, install backdoors, or pivot to other internal servers.โฆ
๐ **Threshold**: **LOW**. ๐ **Access**: Network Accessible (AV:N). ๐ **Auth**: No Privileges Required (PR:N). ๐ค **UI**: No User Interaction Needed (UI:N). It is a critical, easy-to-exploit flaw.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฅ **Public Exp**: **YES**. ๐ **PoCs**: Available on GitHub (Threekiii/Awesome-POC) and Nuclei templates. ๐ **Wild Exploitation**: Likely, given the low barrier to entry and public availability of exploits.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for Roxy-WI instances. ๐งช **Test**: Use Nuclei template `CVE-2022-31137.yaml`. ๐ **Verify**: Check if `/app/options.py` is vulnerable to command injection via `subprocess_execute`.
Q8Is it fixed officially? (Patch/Mitigation)
๐ ๏ธ **Fixed**: **YES**. โ **Patch**: Upgrade to **Roxy-WI version 6.1.1.0** or later. ๐ข **Advisory**: See GHSA-53r2-mq99-f532 for official details.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Implement strict **Input Validation** on `/app/options.py`. ๐ซ **Mitigation**: Restrict network access to Roxy-WI. ๐ **Defense**: Use WAF rules to block OS command injection patterns in HTTP requests.
Q10Is it urgent? (Priority Suggestion)
๐จ **Urgency**: **CRITICAL**. ๐ด **Priority**: **P0**. Immediate patching required. With CVSS High and public PoCs, active exploitation is highly probable. Do not delay! โณ