Horizon Alert
Summary of the vulnerability and why it matters
Roxy-WI, a tool for managing critical network servers, has a vulnerability that could allow an authenticated user to execute commands remotely on managed load balancers. This occurs because certain configuration inputs are not properly validated before being applied, potentially leading to the injection of malicious directives. The main concern is confirming relevance and exposure to ensure affected systems are identified.
- Unvalidated configuration allows remote command execution.
- Impacts management of key network infrastructure.
- Assess relevance and exposure promptly.
Attack Path
How an attacker could exploit the issue
An attacker with a low-level user role in Roxy-WI can inject malicious commands into the server's HAProxy configuration. This is possible because the `section-save` endpoints do not properly validate or escape user-supplied options. When Roxy-WI pushes this modified configuration to the load balancer and restarts HAProxy, the injected commands execute with the privileges of the HAProxy user during health checks.
- Authenticated user with low privileges.
- Sending crafted JSON to API endpoints.
- Remote code execution on the load balancer.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an authenticated user with a low-level role to inject malicious commands into the HAProxy configuration. When the HAProxy service reloads, these commands could be executed with the privileges of the HAProxy user on the load balancer, potentially leading to remote code execution.
- Load balancer configuration and code execution.
- Injecting directives via unvalidated JSON input.
- Compromise of the load balancer service.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Real-world action for this vulnerability likely falls to infrastructure or platform teams responsible for managing Roxy-WI and the load balancers it configures. The first critical step is to identify all instances of Roxy-WI, confirm which load balancers are managed by each instance, and assess the business criticality and exposure of those load balancers. Subsequently, owners of affected load balancers must be identified to plan coordinated remediation efforts, considering that public patches are not yet available.
- Identify affected Roxy-WI instances.
- Verify load balancer reachability and criticality.
- Plan coordinated remediation with owners.
