CVE-2024-43804

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used without validation when constructing and executing an OS command. User supplied JSON POST data is parsed and if "id" JSON key does not exist, JSON value supplied via "ip" JSON key is assigned to the "ip" variable. Later on, "ip" variable which can be controlled by the attacker is used when constructing the cmd and cmd1 strings without any extra validation. Then, server_mod.subprocess_execute function is called on both cmd1 and cmd2. When the definition of the server_mod.subprocess_execute() function is analyzed, it can be seen that subprocess.Popen() is called on the input parameter with shell=True which results in OS Command Injection. This issue has not yet been patched. Users are advised to contact the Roxy-WI to coordinate a fix.

• CWE-78
• CWE-78

• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-qc52-vwwj-5585Exploit, Vendor Advisory

Published

Aug 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43798Chisel is a fast TCP/UDP tunnel, transported over HTTP, secu…8.6
• CVE-2024-43799Send is a library for streaming files from the file system a…4.7
• CVE-2024-43800serve-static serves static files. serve-static passes untrus…4.7
• CVE-2024-43801Jellyfin is an open source self hosted media server. The Jel…5.4
• CVE-2024-43802Vim is an improved version of the unix vi text editor. When …4.5
• CVE-2024-43803The Bare Metal Operator (BMO) implements a Kubernetes API fo…4.9
• CVE-2024-43805jupyterlab is an extensible environment for interactive and …6.1
• CVE-2024-43806Rustix is a set of safe Rust bindings to POSIX-ish APIs. Whe…6.5
• CVE-2024-43807In JetBrains TeamCity before 2024.07.1 multiple stored XSS w…5.4
• CVE-2024-43808In JetBrains TeamCity before 2024.07.1 self XSS was possible…5.4
• CVE-2024-43809In JetBrains TeamCity before 2024.07.1 reflected XSS was pos…6.1
• CVE-2024-4381The CB (legacy) WordPress plugin through 0.9.4.18 does not s…4.8