Impact Analysis

This vulnerability can have severe impacts including allowing an authenticated attacker to execute arbitrary system commands as root on the server hosting roxy-wi. This can lead to full system compromise, including unauthorized access to sensitive data, modification or deletion of files, disruption of services, and potentially using the compromised system as a pivot point for further attacks.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-27811 is a command injection vulnerability in the roxy-wi web interface, which manages Haproxy, Nginx, Apache, and Keepalived servers. The flaw exists in the `/config/compare/<service>/<server_ip>/show` endpoint, where authenticated users can supply input parameters that are directly used to construct shell commands without proper sanitization. This allows attackers to inject and execute arbitrary system commands on the host running the application.

The vulnerability arises because user inputs representing configuration file names are concatenated into a shell command string executed with shell=true, enabling command injection. Exploitation requires valid user credentials with access to the service, but once exploited, it allows full system compromise with root privileges.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to exploit the command injection flaw in the `/config/compare/<service>/<server_ip>/show` endpoint of the roxy-wi application. Authenticated users can test by sending crafted requests with malicious `left` or `right` parameters that include shell commands.'}, {'type': 'paragraph', 'content': 'For example, sending a JSON payload with "left": "; id; whoami; #" and an empty "right" parameter to the endpoint can reveal if arbitrary commands are executed and their output returned.'}, {'type': 'paragraph', 'content': 'Detection commands or steps include using curl or similar tools to send authenticated POST requests to the vulnerable endpoint with payloads designed to execute simple commands like `id` or `whoami` and checking the response for command output.'}, {'type': 'list_item', 'content': 'Use curl to send a test payload: curl -X POST -H "Content-Type: application/json" -d \'{"left": "; id; whoami; #", "right": ""}\' https://<roxy-wi-host>/config/compare/haproxy/<server_ip>/show --cookie "auth_cookie=your_auth_token"'}, {'type': 'list_item', 'content': 'Check the JSON response for output of the injected commands such as user identity and system information.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include upgrading roxy-wi to version 8.2.6.3 or later, where the vulnerability has been fixed by adding input validation, improved error handling, and safer subprocess execution.'}, {'type': 'paragraph', 'content': 'If upgrading is not immediately possible, restrict access to the vulnerable endpoint to trusted users only, and monitor for suspicious activity involving the `/config/compare` endpoint.'}, {'type': 'paragraph', 'content': 'Additional mitigation recommendations include validating that file paths exist and are legitimate, escaping user inputs properly using functions like `shlex.quote`, and modifying subprocess calls to avoid shell interpretation.'}, {'type': 'list_item', 'content': 'Upgrade roxy-wi to version 8.2.6.3 or newer.'}, {'type': 'list_item', 'content': 'Restrict access to the `/config/compare/<service>/<server_ip>/show` endpoint to authenticated and trusted users.'}, {'type': 'list_item', 'content': 'Implement input validation to block malicious inputs such as those containing ".." or shell metacharacters.'}, {'type': 'list_item', 'content': 'Use proper escaping (e.g., `shlex.quote`) for user inputs before passing them to shell commands.'}, {'type': 'list_item', 'content': 'Modify subprocess execution to use argument lists instead of shell strings to prevent shell injection.'}] [1, 2, 3]

Useful 0 Not Useful 0