SB2026110846 - Multiple vulnerabilities in Roxy-WI

Description

This security bulletin contains information about 2 vulnerabilities.

1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated guest to execute arbitrary shell commands on the configured central syslog server using Roxy-WI's stored SSH account.

The vulnerability exists due to unvalidated interpolation of the serv path parameter into a shell command in Roxy-WI's log-viewing endpoint when syslog_server_enable=1 and stored SSH credentials are configured. An authenticated guest can submit a crafted log request containing shell metacharacters to execute commands and receive their output without victim interaction.

2) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged authenticated attacker to originate network probes from another tenant's managed server using that tenant's stored SSH credentials.

The vulnerability exists due to missing server ownership authorization in Roxy-WI's /nettools/* POST handlers when processing the user-controlled server_from parameter. A low-privileged authenticated attacker can supply another tenant's managed server IP with working stored SSH credentials to execute constrained network diagnostics and retrieve results from that server's network.

Remediation

Install update from vendor's website.

References

• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-735r-4xc2-8g7w
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mf6p-vw26-chjw