Description
Roxy-WI 是一个用于管理 Haproxy、Nginx、Apache 和 Keepalived 服务器的 Web 界面。Roxy-WI 6.1.1.0 之前的版本存在远程代码执行漏洞。攻击者可以通过/app/options.py远程执行任意命令。
Roxy-WI CVE-2022-31137 远程命令执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2022-31137
https://avd.aliyun.com/detail?id=AVD-2022-31137
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/Roxy-Wi-options.py-%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CVE-2022-31137.md
https://www.ctfiot.com/78616.html
https://www.ddpoc.com/DVB-2022-3851.html
https://zhuanlan.zhihu.com/p/646846850
https://www.bilibili.com/video/BV1q84y1i7NP/
https://stack.chaitin.com/poc/detail/678
https://pentest-tools.com/vulnerabilities-exploits/roxy-wi-6110-remote-code-execution_27116
https://www.tenable.com/plugins/was/113953
https://www.exploit-db.com/exploits/51227
https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137/
https://ine.com/blog/roxy-wi-unauthenticated-remote-code-executions
https://app.opencve.io/cve/?vendor=roxy-wi