CVE-2024-13129
Published: 03 January 2025
Summary
CVE-2024-13129 is a high-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability in Roxy-WI versions up to 8.1.3 allows remote OS command injection through the action_service function in app/modules/roxywi/roxy.py. The flaw, tracked under CWE-77 and CWE-78, arises when untrusted input to the action and service arguments is passed directly to operating-system commands without proper sanitization. It carries a CVSS 4.0 score of 8.7, reflecting network attack vector, low attack complexity, and low privileges required.
An authenticated remote attacker can supply crafted values for the affected parameters to execute arbitrary operating-system commands on the server. Successful exploitation yields full control over the confidentiality, integrity, and availability of the host, enabling actions such as data exfiltration, persistence, or lateral movement within the environment. Public exploit code has already been published.
The vendor addressed the issue in release 8.1.4 via pull request 410 and commit 32313928eb9ce906887b8a30bf7b9a3d5c0de1be; administrators are advised to upgrade immediately. The current EPSS score of 0.0563 shows no material increase from its recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51362
Vulnerability details
A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack…
more
can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.1.4 is able to address this issue. The identifier of the patch is 32313928eb9ce906887b8a30bf7b9a3d5c0de1be. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in a remotely accessible web application directly enables RCE via Unix shell commands (T1190 for public-facing exploit, T1059.004 for resulting command execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by validating the action/service argument in the roxy.py action_service function before execution.
Remediates the specific flaw through timely patching to Roxy-WI version 8.1.4, eliminating the command injection vulnerability.
Restricts action/service inputs to whitelisted safe values, blocking injection of arbitrary OS commands remotely.