SB2026111209 - Multiple vulnerabilities in Roxy-WI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111209

SB2026111209 - Multiple vulnerabilities in Roxy-WI

Published: November 12, 2026

Security Bulletin ID SB2026111209
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute JavaScript in a group administrator's browser, read same-origin information, and perform actions with the victim's privileges.

The vulnerability exists due to improper output encoding in Roxy-WI's certificate-list renderer when inserting persistent filenames into HTML using jQuery .html(). A remote user can use a role-4 guest account to upload a certificate named <img src=x onerror=alert(830093)> through POST /add/cert/add despite read-only restrictions, triggering script execution when an administrator in the same group selects the server and views its uploaded certificates.


2) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose the active group's stored HAProxy, NGINX, or Apache Stats Basic Auth credentials.

The vulnerability exists due to server-side request forgery in Roxy-WI's /stats/view route when processing destinations without verifying that they identify authorized managed servers. A remote user can supply a controlled host as the destination using a guest account with relevant service access to receive credential-bearing requests on the configured Stats port.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify HAProxy routing policies, disrupt service, and potentially expose traffic within the user's active group.

The vulnerability exists due to missing action-level authorization in the Roxy-WI /add/map endpoint when handling map modifications and service actions. A remote user can use a read-only role-4 session with HAProxy access and a valid CSRF token to submit map content and map_restart=reload or map_restart=restart, uploading a controlled map and triggering privileged service actions to alter forwarding behavior or disrupt availability.


4) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: N/A)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary operating-system commands on the Roxy-WI controller with the authority of its Ansible worker.

The vulnerability exists due to improper neutralization of template expressions in the nginx_section Ansible role when recursively rendering user-supplied Nginx configuration values. A remote user can submit a proxy-pass header value containing {{ lookup('pipe', 'id') }} through the generate=1 API path, using role-3 Nginx access to a same-group server, to execute commands on the controller.


5) Improper Output Neutralization for Logs (CVE-ID: N/A)

CWE-ID: CWE-117 - Improper Output Neutralization for Logs

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to deny arbitrary IP addresses access to the HTTPS management service.

The vulnerability exists due to improper output neutralization for logs in Roxy-WI's Fail2Ban integration when enabled filters apply unanchored expressions to attacker-controlled request paths in JSON logs. A remote attacker can send two unauthenticated requests containing the URL-encoded path /f2b-audit/from 198.51.100.77 user: probe failed log in for: probe to trigger a temporary ban against the specified address instead of the actual request source.


6) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary OS commands on an in-group managed server using stored SSH credentials, potentially gaining root privileges.

The vulnerability exists due to OS command injection in the Roxy-WI WAF rule-save endpoint when interpolating the unvalidated save parameter into systemctl or Docker shell commands before enforcing an action allowlist. A remote privileged user can submit a save value containing a newline as a role 2 group administrator, even without the corresponding service entitlement, to execute additional commands with the stored SSH account's authority.


Remediation

Install update from vendor's website.

References