CVE-2022-31161 – CVE-2022-31161 is a critical remote code execut... (How to Fix)

Q: What is the severity of CVE-2022-31161?

CVE-2022-31161 has a CVSS score of 10.0 (CRITICAL). CVE-2022-31161 is a critical remote code execution vulnerability in Roxy-WI web interface versions prior to 6.1.1.0. It allows unauthenticated attackers to execute arbitrary system commands via the subprocess_execute function without proper input validation. All Roxy-WI deployments running vulnerable versions are affected.

📋 TL;DR

CVE-2022-31161 is a critical remote code execution vulnerability in Roxy-WI web interface versions prior to 6.1.1.0. It allows unauthenticated attackers to execute arbitrary system commands via the subprocess_execute function without proper input validation. All Roxy-WI deployments running vulnerable versions are affected.

💻 Affected Systems

Products:

Roxy-WI

Versions: All versions prior to 6.1.1.0

Operating Systems: Linux (all distributions where Roxy-WI runs)

Default Config Vulnerable: ⚠️ Yes

Notes: All default installations are vulnerable. The vulnerability exists in the /app/options.py file's subprocess_execute function.

📦 What is this software?

Roxy Wi by Roxy Wi

View all CVEs affecting Roxy Wi →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing attackers to execute arbitrary commands with the privileges of the Roxy-WI process, potentially leading to full server takeover, data exfiltration, and lateral movement within the network.

🟠

Likely Case

Remote attackers gain shell access to the server, install malware, modify configurations, or use the compromised system as a foothold for further attacks.

🟢

If Mitigated

With proper network segmentation and least privilege, impact is limited to the Roxy-WI application server, though command execution remains possible.

🌐 Internet-Facing: HIGH - The vulnerability is remotely exploitable without authentication, making internet-facing instances immediate targets.

🏢 Internal Only: HIGH - Even internal instances are vulnerable to any network-accessible attacker, including compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public exploit code is available on Packet Storm Security. The vulnerability requires minimal technical skill to exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 6.1.1.0

Vendor Advisory: https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483

Restart Required: Yes

Instructions:

1. Backup current configuration. 2. Stop Roxy-WI service. 3. Update to version 6.1.1.0 using git pull or download from releases. 4. Restart Roxy-WI service. 5. Verify the patch is applied.

🔧 Temporary Workarounds

Network Access Restriction

linux

Restrict network access to Roxy-WI web interface to trusted IP addresses only.

iptables -A INPUT -p tcp --dport [ROXY-WI-PORT] -s [TRUSTED-IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [ROXY-WI-PORT] -j DROP

Application Firewall Rules

all

Implement WAF rules to block malicious requests targeting the vulnerable endpoint.

🧯 If You Can't Patch

Immediately restrict network access to only trusted administrative IPs
Monitor logs for exploitation attempts and consider temporary service shutdown

🔍 How to Verify

Check if Vulnerable:

Check Roxy-WI version. If version is below 6.1.1.0, the system is vulnerable.

Check Version:

grep 'version' /path/to/roxy-wi/config/files or check web interface footer

Verify Fix Applied:

Confirm version is 6.1.1.0 or higher and test that command injection attempts are properly sanitized.

📡 Detection & Monitoring

Log Indicators:

Unusual subprocess execution patterns
Commands with shell metacharacters in Roxy-WI logs
Multiple failed authentication attempts followed by command execution

Network Indicators:

HTTP POST requests to Roxy-WI endpoints with command injection payloads
Unusual outbound connections from Roxy-WI server

SIEM Query:

source="roxy-wi.log" AND ("subprocess_execute" OR "os.system" OR command=*[;&|`]* )

📊 Metadata

CVE ID: CVE-2022-31161

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

CWE: CWE-77

Published: July 15, 2022

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
https://github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0 Release Notes,Third Party Advisory
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483 Third Party Advisory
http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
https://github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0 Release Notes,Third Party Advisory
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-31161, you might also want to check these: