CVE-2026-33078: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-33078 is a SQL injection vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw exists in the haproxy_section_save function within app/routes/config/routes.py, where the server_ip URL path parameter is passed unsanitized into a SQL query via Python string formatting. All versions prior to 8.2.6.4 are affected. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.9 (High), and was publicly disclosed on April 24, 2026 (GitHub Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from unsanitized user-controlled input being interpolated directly into a SQL query string. The vulnerable code flow begins at the route handler @bp.route('/section/haproxy/<server_ip>/save', methods=['POST']), where server_ip is extracted from the URL path without validation and passed through config_mod.master_slave_upload_and_restart() into server_sql.is_master(), which constructs the query as "... where master.ip = '%s'" % ip and executes it directly. No authentication is required to reach this endpoint, making the attack fully unauthenticated and remotely exploitable over the network. The fix in version 8.2.6.4 introduces Pydantic-based type validation (Union[IPvAnyAddress, DomainName]) on the server_ip parameter across multiple route handlers (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database. This can result in exfiltration of sensitive data including user credentials and server configurations, authentication bypass or privilege escalation if the database underpins authentication logic, and modification or deletion of database records. In certain database configurations (e.g., PostgreSQL with COPY TO/FROM PROGRAM), SQL injection can escalate to arbitrary operating system command execution on the database server (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, which provides a concrete malicious payload and step-by-step instructions for crafting a POST request to the vulnerable endpoint. The CVSS v4.0 exploit maturity is rated as "Proof of Concept." The EPSS score is approximately 0.03%, and there is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing. The vulnerability is detected by Qualys scanner (detection ID 5012985) (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Roxy-WI instances running versions prior to 8.2.6.4 using tools like Shodan or Censys, searching for the Roxy-WI web interface on common HTTP/HTTPS ports.
2. Identify the vulnerable endpoint: Target the HAProxy section save route at POST /section/haproxy/<server_ip>/save, where <server_ip> is the injectable URL path parameter.
3. Craft the malicious payload: Replace the <server_ip> path segment with a SQL injection payload, for example: ' UNION SELECT username, password FROM users --.
4. Send the exploit request: Issue a POST request to /section/haproxy/' UNION SELECT username, password FROM users --/save with any required POST body fields (e.g., config).
5. Extract results: The injected UNION SELECT causes the database to return user credentials or other sensitive data in the query result, which may be reflected in the application response or observable via error messages.
6. Escalate (optional): Depending on database permissions and type, leverage additional SQL commands (e.g., COPY TO/FROM PROGRAM in PostgreSQL) to achieve remote code execution on the server (GitHub Advisory).

• Network: Unusual POST requests to /section/haproxy/<path>/save where the path segment contains SQL metacharacters such as single quotes ('), UNION, SELECT, --, or other SQL keywords; unexpected outbound connections from the Roxy-WI server to external hosts.
• Logs: Web server or application access logs showing requests to /section/haproxy/ endpoints with URL-encoded or raw SQL syntax in the path (e.g., %27, UNION+SELECT, --); database error messages or unusual query patterns in application logs.
• File System: Unexpected files written to the server if RCE was achieved via database functionality; new or modified configuration files in Roxy-WI directories.
• Process: Unusual child processes spawned by the database process (e.g., bash, sh, curl, wget) if SQL-to-OS command execution was leveraged (GitHub Advisory).

Upgrade Roxy-WI to version 8.2.6.4 or later, which introduces strict IP/DNS validation using Pydantic's Union[IPvAnyAddress, DomainName] type enforcement on the server_ip parameter across all affected route handlers, preventing malicious input from reaching the SQL layer. As an interim workaround, restrict network-level access to the Roxy-WI web interface using firewall rules or reverse proxy authentication to limit exposure to trusted IP ranges only. Replacing string-formatted SQL queries with parameterized queries (as recommended in the advisory) is the correct long-term code-level fix (GitHub Advisory, Patch Commit).