CVE-2022-31137 (Python, published 2022-07-08T20:15Z)
Description: value: Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/hap-wi/roxy-wi
Files changed:
app/options.py
Commit message: v6.1.1.0

Change log: https://roxy-wi.org/changelog.py#6_1_1


Vulnerable code:
    cert_id = form.getvalue('getcert')
    if funct.checkAjaxInput(cert_id):
        print('error: Nice try')
        sys.exit()
    if funct.checkAjaxInput(cert_id):
        print('error: Nice try')
        sys.exit()

        name = form.getvalue('ssl_name')
        if funct.checkAjaxInput(name):
            print('error: Nice try')
            sys.exit()
    backend = form.getvalue('ipbackend')
    if funct.checkAjaxInput(backend):
        print('error: Nice try')
        sys.exit()
    backend = form.getvalue('ipbackend')
    backend_server = form.getvalue('backend_server')
    if funct.checkAjaxInput(backend) or funct.checkAjaxInput(backend_server):
        print('error: Nice try')
        sys.exit()
    backend_backend = form.getvalue('backend_backend')
    backend_server = form.getvalue('backend_server')
    backend_ip = form.getvalue('backend_ip')
    backend_port = form.getvalue('backend_port')
    if any((funct.checkAjaxInput(backend_backend), funct.checkAjaxInput(backend_server), funct.checkAjaxInput(backend_ip), funct.checkAjaxInput(backend_port))):
        print('error: Nice try')
        sys.exit()
    serv = form.getvalue('maxconn_select')
    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()
    frontend = form.getvalue('maxconn_frontend')
    maxconn = form.getvalue('maxconn_int')
    if funct.checkAjaxInput(frontend) or funct.checkAjaxInput(maxconn):
        print('error: Nice try')
        sys.exit()
    ip = form.getvalue('ip_for_delete')
    table = form.getvalue('table_for_delete')

    if funct.checkAjaxInput(ip) or funct.checkAjaxInput(table):
        print('error: Nice try')
        sys.exit()
    table = form.getvalue('table_for_clear')

    if funct.checkAjaxInput(table):
        print('error: Nice try')
        sys.exit()
    list_id = form.getvalue('list_select_id')
    list_name = form.getvalue('list_select_name')

    if funct.checkAjaxInput(list_id) or funct.checkAjaxInput(list_name):
        print('error: Nice try')
        sys.exit()
    lib_path = funct.get_config_var('main', 'lib_path')
    ip_id = form.getvalue('list_ip_id_for_delete')
    ip = form.getvalue('list_ip_for_delete')
    list_id = form.getvalue('list_id_for_delete')
    list_name = form.getvalue('list_name')
    user_group = funct.get_user_group(id=1)

    if any((funct.checkAjaxInput(ip_id), funct.checkAjaxInput(ip), funct.checkAjaxInput(list_id), funct.checkAjaxInput(list_name))):
        print('error: Nice try')
        sys.exit()

    list_id = form.getvalue('list_id_for_add')
    list_name = form.getvalue('list_name')
    user_group = funct.get_user_group(id=1)

    if any((funct.checkAjaxInput(lists_path), funct.checkAjaxInput(list_id), funct.checkAjaxInput(list_name))):
        print('error: Nice try')
        sys.exit()

    serv = form.getvalue('sessions_select')

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()
    serv = form.getvalue('sessions_select_show')
    sess_id = form.getvalue('sessions_select_id')

    if funct.checkAjaxInput(serv) or funct.checkAjaxInput(sess_id):
        print('error: Nice try')
        sys.exit()


    sess_id = form.getvalue('session_delete_id')

    if funct.checkAjaxInput(sess_id):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(sess_id):
        print('error: Nice try')
        sys.exit()

    action = form.getvalue('action_service')

    if funct.checkAjaxInput(action):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(action):
        print('error: Nice try')
        sys.exit()
    enable = form.getvalue('servaction')
    backend = form.getvalue('servbackend')

    if funct.checkAjaxInput(enable) or funct.checkAjaxInput(backend):
        print('error: Nice try')
        sys.exit()
    left = form.getvalue('left')
    right = form.getvalue('right')

    if funct.checkAjaxInput(left) or funct.checkAjaxInput(right):
        print('error: Nice try')
        sys.exit()
    sshdel = form.getvalue('sshdel')

    if funct.checkAjaxInput(sshdel):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(sshdel):
        print('error: Nice try')
        sys.exit()
    name = form.getvalue('name')

    if funct.checkAjaxInput(name):
        print('error: Nice try')
        sys.exit()
    serv = form.getvalue('showBytes')

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()
    enable = form.getvalue('waf_en')
    rule_id = form.getvalue('waf_rule_id')

    if funct.checkAjaxInput(enable) or funct.checkAjaxInput(rule_id):
        print('error: Nice try')
        sys.exit()
    name = form.getvalue('ovpnname')

    if funct.checkAjaxInput(name):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(name):
        print('error: Nice try')
        sys.exit()
    openvpndel = form.getvalue('openvpndel')

    if funct.checkAjaxInput(openvpndel):
        print('error: Nice try')
        sys.exit()
    openvpn = form.getvalue('openvpnprofile')
    action = form.getvalue('actionvpn')

    if funct.checkAjaxInput(openvpn) or funct.checkAjaxInput(action):
        print('error: Nice try')
        sys.exit()
    serv_id = form.getvalue('scan_ports')

    if funct.checkAjaxInput(serv_id):
        print('error: Nice try')
        sys.exit()

    serv = form.getvalue('viewFirewallRules')

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()

    server_id = form.getvalue('server_id')
    service = form.getvalue('service')

    if funct.checkAjaxInput(server_id) or funct.checkAjaxInput(service):
        print('error: Nice try')
        sys.exit()

Fixed code:
    cert_id = funct.checkAjaxInput(form.getvalue('getcert'))
    cert_id = form.getvalue('delcert')
    cert_id = funct.checkAjaxInput(cert_id)
        name = funct.checkAjaxInput(form.getvalue('ssl_name'))
    backend = funct.checkAjaxInput(form.getvalue('ipbackend'))
    backend = funct.checkAjaxInput(form.getvalue('ipbackend'))
    backend_server = funct.checkAjaxInput(form.getvalue('backend_server'))
    backend_backend = funct.checkAjaxInput(form.getvalue('backend_backend'))
    backend_server = funct.checkAjaxInput(form.getvalue('backend_server'))
    backend_ip = funct.checkAjaxInput(form.getvalue('backend_ip'))
    backend_port = funct.checkAjaxInput(form.getvalue('backend_port'))

    serv = funct.checkAjaxInput(form.getvalue('maxconn_select'))
    frontend = funct.checkAjaxInput(form.getvalue('maxconn_frontend'))
    maxconn = funct.checkAjaxInput(form.getvalue('maxconn_int'))
    ip = funct.checkAjaxInput(form.getvalue('ip_for_delete'))
    table = funct.checkAjaxInput(form.getvalue('table_for_delete'))
    table = funct.checkAjaxInput(form.getvalue('table_for_clear'))
    list_id = funct.checkAjaxInput(form.getvalue('list_select_id'))
    list_name = funct.checkAjaxInput(form.getvalue('list_select_name'))
    lib_path = funct.checkAjaxInput(funct.get_config_var('main', 'lib_path'))
    ip_id = funct.checkAjaxInput(form.getvalue('list_ip_id_for_delete'))
    ip = funct.checkAjaxInput(form.getvalue('list_ip_for_delete'))
    list_id = funct.checkAjaxInput(form.getvalue('list_id_for_delete'))
    list_name = funct.checkAjaxInput(form.getvalue('list_name'))
    user_group = funct.checkAjaxInput(funct.get_user_group(id=1))
    list_id = funct.checkAjaxInput(form.getvalue('list_id_for_add'))
    list_name = funct.checkAjaxInput(form.getvalue('list_name'))
    user_group = funct.checkAjaxInput(funct.get_user_group(id=1))
    serv = funct.checkAjaxInput(form.getvalue('sessions_select'))
    serv = funct.checkAjaxInput(form.getvalue('sessions_select_show'))
    sess_id = funct.checkAjaxInput(form.getvalue('sessions_select_id'))

    sess_id = funct.checkAjaxInput(form.getvalue('session_delete_id'))
    action = funct.checkAjaxInput(form.getvalue('action_service'))
    enable = funct.checkAjaxInput(form.getvalue('servaction'))
    backend = funct.checkAjaxInput(form.getvalue('servbackend'))
    left = funct.checkAjaxInput(form.getvalue('left'))
    right = funct.checkAjaxInput(form.getvalue('right'))
    sshdel = funct.checkAjaxInput(form.getvalue('sshdel'))
    name = funct.checkAjaxInput(form.getvalue('name'))
    serv = funct.checkAjaxInput(form.getvalue('showBytes'))
    enable = funct.checkAjaxInput(form.getvalue('waf_en'))
    rule_id = funct.checkAjaxInput(form.getvalue('waf_rule_id'))
    name = funct.checkAjaxInput(form.getvalue('ovpnname'))
    openvpndel = funct.checkAjaxInput(form.getvalue('openvpndel'))
    openvpn = funct.checkAjaxInput(form.getvalue('openvpnprofile'))
    action = funct.checkAjaxInput(form.getvalue('actionvpn'))
    serv_id = funct.checkAjaxInput(form.getvalue('scan_ports'))
    serv = funct.checkAjaxInput(form.getvalue('viewFirewallRules'))
    server_id = funct.checkAjaxInput(form.getvalue('server_id'))
    service = funct.checkAjaxInput(form.getvalue('service'))