CVE-2023-25802 (HTML, published 2023-03-13T20:15Z)
Description: value: Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/hap-wi/roxy-wi
Files changed:
app/modules/roxywi/logs.py
app/modules/server/ssh.py
app/scripts/ansible/roles/haproxy/tasks/logs.yml
app/templates/ajax/new_ssh.html
app/templates/base.html
app/templates/hapservers.html
app/templates/include/admin_add_user.html
app/templates/include/admin_ssh.html
app/templates/languages/en.html
app/templates/languages/ru.html
inc/overview.js
Commit message: v6.3.6.0

Changelog: https://roxy-wi.org/changelog#6_3_6


Vulnerable code:
	user_group = roxywi_common.get_user_group()
	name = f'{name}_{user_group}'
						{% if ssh.5 == group.group_id %}
		<meta id="translate" style="display: none;" data-delete="{{lang.words.delete|title()}}" data-cancel="{{lang.words.cancel|title()}}"  data-add="{{lang.words.add|title()}}" \
			  data-generated_config="{{lang.words.generated|title()}} {{lang.words.config}}" />
  <p><span class="ui-icon ui-icon-alert" style="float:left; margin:3px 12px 20px 0;"></span>Are you sure?</p>
		New user
				<a href="#" title="Search user in AD" id="search_ldap_user">Search user in AD</a>
		Password
	<td class="padding20">Active</td>
		Email
                {% if ssh.5 == group.group_id %}
		title: "Are you sure you want to "+ action + " " + id + "?",
		buttons: {
			"Sure": function() {
				$( this ).dialog( "close" );
				if(service == "haproxy") {
					if(action == "restart" || action == "reload") {
						if(localStorage.getItem('restart')) {
			},
			Cancel: function() {
		}
					title: "Settings for " + name,
					buttons: {
						"Save": function () {
						},
						Cancel: function () {
					}

Fixed code:
	if '..' in log_file: return 'error: nice try'

	group_name = sql.get_group_name_by_id(group)
	name = f'{name}_{group_name}'
	if '..' in name:
		print('error: nice try')
		return False

  when: (ansible_facts['os_family'] == "RedHat" or ansible_facts['os_family'] == 'CentOS')
						{% if ssh.groups == group.group_id %}
		<meta id="translate" style="display: none;" data-delete="{{lang.words.delete|title()}}" data-cancel="{{lang.words.cancel|title()}}" data-add="{{lang.words.add|title()}}"
			  data-generated_config="{{lang.words.generated|title()}} {{lang.words.config}}" data-restart="{{lang.words.restart|title()}}" data-start="{{lang.words.start|title()}}"
			  data-stop="{{lang.words.stop|title()}}" data-reload="{{lang.words.reload|title()}}" data-user_groups="{{lang.phrases.user_groups}}" data-settings="{{lang.words.settings|title()}}"
			  data-for="{{lang.words.for}}" />
  <p><span class="ui-icon ui-icon-alert" style="float:left; margin:3px 12px 20px 0;"></span>{{lang.phrases.are_you_sure}}</p>
		{{lang.words.name|title()}}
				<a href="#" title="{{lang.phrases.search_id_ad}}" id="search_ldap_user">{{lang.phrases.search_in_ad}}</a>
		{{lang.words.password|title()}}
	<td class="padding20">{{lang.words.active|title()}}</td>
		{{lang.words.email|title()}}
                {% if ssh.groups == group.group_id %}
    "user_groups": "User groups",
    "roles": "roles",
    "user_groups": "Пользовательские группы",
    "roles": "роли",
	var cancel_word = $('#translate').attr('data-cancel');
	var action_word = $('#translate').attr('data-'+action);
		title: action_word + " " + id + "?",
		buttons: [{
			text: action_word,
			click: function () {
				$(this).dialog("close");
				if (service == "haproxy") {
					if (action == "restart" || action == "reload") {
						if (localStorage.getItem('restart')) {
			}
		}, {
			text: cancel_word,
			click: function() {
		}]
	var cancel_word = $('#translate').attr('data-cancel');
	var save_word = $('#translate').attr('data-save');
	var settings_word = $('#translate').attr('data-settings');
	var for_word = $('#translate').attr('data-for');
					title: settings_word + " "+for_word+" " + name,
					buttons: [{
						text: save_word,
						click: function () {
						}
					}, {
						text: cancel_word,
						click: function () {
					}]