CVE-2024-43804: OS Command Injection via Port Scan Functionality in Roxy-WI
First published: Thu Aug 29 2024(Updated: )
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used without validation when constructing and executing an OS command. User supplied JSON POST data is parsed and if "id" JSON key does not exist, JSON value supplied via "ip" JSON key is assigned to the "ip" variable. Later on, "ip" variable which can be controlled by the attacker is used when constructing the cmd and cmd1 strings without any extra validation. Then, server_mod.subprocess_execute function is called on both cmd1 and cmd2. When the definition of the server_mod.subprocess_execute() function is analyzed, it can be seen that subprocess.Popen() is called on the input parameter with shell=True which results in OS Command Injection. This issue has not yet been patched. Users are advised to contact the Roxy-WI to coordinate a fix.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Roxy-wi | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-43804?
CVE-2024-43804 is considered a high severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2024-43804?
To fix CVE-2024-43804, validate and sanitize user input in the port scanning functionality to prevent command injection.
Who is affected by CVE-2024-43804?
CVE-2024-43804 affects authenticated users of Roxy-WI version 8.0.
What could happen if CVE-2024-43804 is exploited?
Exploitation of CVE-2024-43804 could allow an attacker to execute arbitrary commands on the web application server.
Is there a patch available for CVE-2024-43804?
As of now, no official patch has been released for CVE-2024-43804, so immediate mitigation steps should be taken.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/roxy-wi
- canonical/roxy-wi
- version/roxy-wi/8.0