CVE-2022-31137 Scanner

Roxy-WI is a web-based interface used by system administrators to manage HAProxy, Nginx, and Keepalived servers. It simplifies load balancing and high availability configurations in data centers and critical infrastructure across industries like telecom, finance, and healthcare. As an open-source tool, it offers cost-effective server management but requires vigilant security updates.

CVE-2022-31137 is a critical Remote Code Execution (RCE) vulnerability in Roxy-WI. It arises from insufficient input validation in the subprocess_execute function, which handles user-supplied commands. This flaw allows attackers to inject malicious commands without proper sanitization, leading to arbitrary code execution.

The vulnerability specifically affects the subprocess_execute function in the backend code, where parameters are not properly filtered. An attacker can exploit this by sending crafted HTTP requests to the vulnerable endpoint, bypassing authentication and executing system-level commands on the host server.

If exploited, an attacker gains full control over the Roxy-WI server, enabling data theft, malware installation, or lateral movement within the network. Given the CVSS score of 9.8, this poses a severe risk to organizations relying on Roxy-WI for critical infrastructure management.