Executive Summary

This vulnerability exists in Roxy-WI, a web interface for managing load balancers like Haproxy, Nginx, Apache, and Keepalived. In versions 8.2.6.4 and earlier, an authenticated group administrator can exploit insufficient validation of the config_file_name parameter in the WAF rule save functionality. By encoding forward slashes as '92', an attacker can write arbitrary files to any location on the load balancer filesystem.

Specifically, the attacker can write a malicious cron job file to the /etc/cron.d/ directory. Since cron executes these files as root during its periodic scans, this leads to remote code execution (RCE) with root privileges on all load balancers managed by the attacker’s group.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated group administrator to gain full remote code execution on all load balancers they manage. The attacker can execute arbitrary commands as root, potentially leading to complete system compromise.

• Full control over load balancer servers.
• Ability to execute malicious code with root privileges.
• Potential disruption or manipulation of network traffic managed by the load balancers.
• Risk of further lateral movement or persistent access within the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated arbitrary file write via the config_file_name parameter in the WAF rule save functionality of Roxy-WI. Detection can focus on monitoring for suspicious POST requests to the endpoint /waf/<service>/<server_ip>/rule/<rule_id>/save with unusual config_file_name values that encode slashes as '92', such as '92etc92cron.d92nginx_cfg_evil'.

You can detect exploitation attempts by inspecting web server logs for POST requests containing encoded slashes (92) in the config_file_name parameter.

Additionally, check for unexpected files in cron directories, for example, by running commands like:

• ls -l /etc/cron.d/
• grep -r 'nginx_cfg_evil' /etc/cron.d/
• auditctl -w /etc/cron.d/ -p wa -k cron_watch

Monitoring for new or modified cron files and unusual cron jobs can help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the Roxy-WI interface to trusted administrators only, as exploitation requires authentication with group admin privileges.

Avoid using vulnerable versions of Roxy-WI (versions 8.2.6.4 and prior) and monitor for any updates or patches from the vendor, although at the time of publication no public patches are available.

Implement network-level controls such as firewall rules to limit access to the management interface.

Regularly audit the filesystem, especially cron directories, for unauthorized files or changes.

Consider temporarily disabling or restricting the WAF rule save functionality if possible until a patch is available.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated group administrators to achieve remote code execution on all managed load balancers by writing arbitrary files, including malicious cron jobs, which execute with root privileges. This can lead to unauthorized access, data manipulation, and full system compromise.

Such a compromise can severely impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and system security. Unauthorized root access and remote code execution violate these principles, potentially leading to data breaches and regulatory non-compliance.

Useful 0 Not Useful 0