Termix
Monthly
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can edit a tunnel's host fields achieve arbitrary command execution. Attacker-controlled values (endpointPort, sourcePort, endpointUsername, endpointIP) are interpolated into single-quoted pkill -f patterns in src/backend/ssh/tunnel.ts, so a single quote breaks out of the pattern and appends a shell command that runs when DELETE /ssh/tunnel/disconnect/:tunnelName tears the tunnel down. Commands execute on the source SSH host with the privileges of the connected SSH account. No public exploit identified at time of analysis; fixed in 2.3.2.
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. Fixed in 2.3.2; no public exploit identified at time of analysis, though a detailed advisory and patch commit make the flaw well understood.
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-manager access to execute arbitrary commands on a managed SSH host prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-supplied file basenames directly to GNU tar without an end-of-options delimiter, enabling an attacker to supply filenames matching tar checkpoint options (e.g., --checkpoint=1, --checkpoint-action=exec=<cmd>) that tar interprets as directives rather than operands. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploitation technique is well-documented and the CVSS score of 8.8 reflects genuine high-priority risk for all pre-2.3.2 deployments.
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. Rated CVSS 9.6 (scope-changed) because the leaked credentials grant control of the external systems Termix manages; no public exploit identified at time of analysis, and it is not in CISA KEV.
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-reset tokens belonging to other local accounts via the POST /database/export endpoint, enabling full account takeover of any local user including administrators. The database export is intended to be user-scoped but incorrectly includes the global settings table, which stores transient reset_code_ and temp_reset_token_ artifacts from incomplete or historical password-reset flows. With CVSS 8.8 (PR:L, C:H/I:H/A:H) and a public GitHub advisory, this represents a high-severity privilege escalation path in deployments where multiple user accounts exist. No public exploit identified at time of analysis; vendor-released patch is available.
Server-Side Request Forgery in Termix prior to 2.3.2 allows authenticated users to weaponize the proxy connectivity test endpoint as an internal network scanner and cloud credential harvester. The POST /host/db/proxy/test endpoint blindly forwards raw TCP and SOCKS connections to attacker-controlled addresses supplied via singleProxy, proxyChain, and testTarget fields, enabling traversal to localhost services, RFC-1918 private networks, and link-local cloud metadata endpoints such as 169.254.169.254. Structured connection error responses and timing data leak host reachability, and successful metadata service access directly exposes cloud provider IAM credentials usable for lateral movement. No public exploit is identified at time of analysis, but the attack is trivially reproducible given the granular advisory disclosure.
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitrary shell commands on remote SSH-managed hosts via the File Manager's resolvePath endpoint. The flaw stems from incomplete shell escaping that only handles double quotes while leaving command substitution syntax interpretable. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-v26q-rpv5-9m72) and CVSS 9.0 rating signal high impact across confidentiality, integrity, and availability of downstream SSH targets.
Authentication bypass of MFA in Termix versions prior to 2.3.2 allows an attacker who already holds a victim's account password to disable TOTP or regenerate backup codes via the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, completely neutralizing the second factor. The flaw stems from these MFA-critical endpoints accepting the account password as the sole authentication factor, meaning credential stuffing, phishing, or a leaked password hash (referenced as GHSA-xxxx) is sufficient to defeat 2FA. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated attackers to execute arbitrary commands on the source SSH host via the POST /ssh/tunnel/connect endpoint. The flaw stems from user-controlled host record fields being interpolated directly into shell commands without escaping, yielding persistent code execution. No public exploit identified at time of analysis, but a vendor-released patch is available in version 2.3.2.
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an authenticated low-privileged user to hijack another user's active File Manager session by tampering with a client-supplied sessionId, gaining full read/write/execute access to that victim's remote VPS over their established SSH connection. The CVSS 9.0 score reflects scope change (the compromised session crosses the trust boundary into the victim's separate VPS) and high impact across CIA. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the trivial nature of incrementing/guessing an unvalidated identifier makes exploitation straightforward once a foothold account exists.
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticated user with an active File Manager SSH session to execute arbitrary OS commands on the connected remote host via the GET /ssh/file_manager/ssh/resolvePath endpoint. The vulnerability stems from improper shell escaping that fails to neutralize $(...) and backtick command substitution, yielding a CVSS 9.9 critical rating with scope change. No public exploit identified at time of analysis, but the vendor advisory (GHSA-37f4-wq95-pg33) provides sufficient technical detail to develop one trivially.
Cross-tenant SSH session hijacking in Termix versions prior to 2.3.2 allows any authenticated user to fully control another user's connected SSH host via predictable session identifiers. Sixteen file-manager endpoints fail to verify ownership of the `sessionId` parameter, enabling read, write, delete, download, and execute operations on victim hosts. No public exploit identified at time of analysis, but the multi-tenant deployment model and low attack complexity make this a high-priority issue for shared installations.
Machine-in-the-middle interception of HTTPS traffic in Termix Desktop (Electron) starting at version 1.7.0 allows attackers positioned on the network path to steal login credentials and JWT/session tokens because the Electron client disables TLS certificate validation entirely. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 8.0 rating with scope-change and the absence of any vendor-released patch make this a meaningful concern for any user running Termix Desktop on untrusted networks.
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenticated user run arbitrary OS commands on any managed remote server. The Docker container-management endpoints pass the attacker-controlled containerId (from the URL path and WebSocket messages) straight into shell commands run over SSH via ssh2.Client.exec() with no sanitization, so a crafted container ID achieves full command injection. Rated CVSS 9.9 with no public exploit identified at time of analysis; EPSS is very low (0.07%) and it is not on CISA KEV.
Command injection in Termix (a self-hosted web-based SSH/server-management platform) before version 2.1.0 lets attackers execute arbitrary OS commands on managed remote SSH hosts. The extractArchive and compressFiles endpoints in file-manager.ts build shell commands using double-quoted strings, which — unlike the single-quote escaping used everywhere else in the file manager — permit $(command) substitution in attacker-controlled input. SSVC classifies exploitation as PoC-stage (publicly available exploit code exists), it is not in CISA KEV, and EPSS is low (0.16%, 37th percentile), indicating no observed widespread exploitation; the flaw is fixed in 2.1.0.
Authentication bypass in Termix (self-hosted SSH web management platform) before version 2.1.0 lets an attacker who knows only a victim's password bypass TOTP two-factor authentication. The /users/login endpoint issues a temporary JWT (temp_token) carrying a pendingTOTP state that should only unlock the second-factor step, but the auth middleware wrongly accepts this token on fully authenticated endpoints, collapsing 2FA into single-factor password authentication for every TOTP-enabled account. Publicly available exploit code exists (SSVC exploitation: poc), though EPSS probability is very low (0.01%, 1st percentile) and there is no evidence of active exploitation.
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary JavaScript by uploading malicious SVG files that bypass content sanitization. When a Termix user previews the crafted file, the payload executes within the application context with full access to sensitive operations. Public exploit code exists and no patch is currently available.
Docker default credentials in Termix server management. PoC and patch available.
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can edit a tunnel's host fields achieve arbitrary command execution. Attacker-controlled values (endpointPort, sourcePort, endpointUsername, endpointIP) are interpolated into single-quoted pkill -f patterns in src/backend/ssh/tunnel.ts, so a single quote breaks out of the pattern and appends a shell command that runs when DELETE /ssh/tunnel/disconnect/:tunnelName tears the tunnel down. Commands execute on the source SSH host with the privileges of the connected SSH account. No public exploit identified at time of analysis; fixed in 2.3.2.
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. Fixed in 2.3.2; no public exploit identified at time of analysis, though a detailed advisory and patch commit make the flaw well understood.
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-manager access to execute arbitrary commands on a managed SSH host prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-supplied file basenames directly to GNU tar without an end-of-options delimiter, enabling an attacker to supply filenames matching tar checkpoint options (e.g., --checkpoint=1, --checkpoint-action=exec=<cmd>) that tar interprets as directives rather than operands. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploitation technique is well-documented and the CVSS score of 8.8 reflects genuine high-priority risk for all pre-2.3.2 deployments.
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. Rated CVSS 9.6 (scope-changed) because the leaked credentials grant control of the external systems Termix manages; no public exploit identified at time of analysis, and it is not in CISA KEV.
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-reset tokens belonging to other local accounts via the POST /database/export endpoint, enabling full account takeover of any local user including administrators. The database export is intended to be user-scoped but incorrectly includes the global settings table, which stores transient reset_code_ and temp_reset_token_ artifacts from incomplete or historical password-reset flows. With CVSS 8.8 (PR:L, C:H/I:H/A:H) and a public GitHub advisory, this represents a high-severity privilege escalation path in deployments where multiple user accounts exist. No public exploit identified at time of analysis; vendor-released patch is available.
Server-Side Request Forgery in Termix prior to 2.3.2 allows authenticated users to weaponize the proxy connectivity test endpoint as an internal network scanner and cloud credential harvester. The POST /host/db/proxy/test endpoint blindly forwards raw TCP and SOCKS connections to attacker-controlled addresses supplied via singleProxy, proxyChain, and testTarget fields, enabling traversal to localhost services, RFC-1918 private networks, and link-local cloud metadata endpoints such as 169.254.169.254. Structured connection error responses and timing data leak host reachability, and successful metadata service access directly exposes cloud provider IAM credentials usable for lateral movement. No public exploit is identified at time of analysis, but the attack is trivially reproducible given the granular advisory disclosure.
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitrary shell commands on remote SSH-managed hosts via the File Manager's resolvePath endpoint. The flaw stems from incomplete shell escaping that only handles double quotes while leaving command substitution syntax interpretable. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-v26q-rpv5-9m72) and CVSS 9.0 rating signal high impact across confidentiality, integrity, and availability of downstream SSH targets.
Authentication bypass of MFA in Termix versions prior to 2.3.2 allows an attacker who already holds a victim's account password to disable TOTP or regenerate backup codes via the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, completely neutralizing the second factor. The flaw stems from these MFA-critical endpoints accepting the account password as the sole authentication factor, meaning credential stuffing, phishing, or a leaked password hash (referenced as GHSA-xxxx) is sufficient to defeat 2FA. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated attackers to execute arbitrary commands on the source SSH host via the POST /ssh/tunnel/connect endpoint. The flaw stems from user-controlled host record fields being interpolated directly into shell commands without escaping, yielding persistent code execution. No public exploit identified at time of analysis, but a vendor-released patch is available in version 2.3.2.
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an authenticated low-privileged user to hijack another user's active File Manager session by tampering with a client-supplied sessionId, gaining full read/write/execute access to that victim's remote VPS over their established SSH connection. The CVSS 9.0 score reflects scope change (the compromised session crosses the trust boundary into the victim's separate VPS) and high impact across CIA. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the trivial nature of incrementing/guessing an unvalidated identifier makes exploitation straightforward once a foothold account exists.
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticated user with an active File Manager SSH session to execute arbitrary OS commands on the connected remote host via the GET /ssh/file_manager/ssh/resolvePath endpoint. The vulnerability stems from improper shell escaping that fails to neutralize $(...) and backtick command substitution, yielding a CVSS 9.9 critical rating with scope change. No public exploit identified at time of analysis, but the vendor advisory (GHSA-37f4-wq95-pg33) provides sufficient technical detail to develop one trivially.
Cross-tenant SSH session hijacking in Termix versions prior to 2.3.2 allows any authenticated user to fully control another user's connected SSH host via predictable session identifiers. Sixteen file-manager endpoints fail to verify ownership of the `sessionId` parameter, enabling read, write, delete, download, and execute operations on victim hosts. No public exploit identified at time of analysis, but the multi-tenant deployment model and low attack complexity make this a high-priority issue for shared installations.
Machine-in-the-middle interception of HTTPS traffic in Termix Desktop (Electron) starting at version 1.7.0 allows attackers positioned on the network path to steal login credentials and JWT/session tokens because the Electron client disables TLS certificate validation entirely. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 8.0 rating with scope-change and the absence of any vendor-released patch make this a meaningful concern for any user running Termix Desktop on untrusted networks.
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenticated user run arbitrary OS commands on any managed remote server. The Docker container-management endpoints pass the attacker-controlled containerId (from the URL path and WebSocket messages) straight into shell commands run over SSH via ssh2.Client.exec() with no sanitization, so a crafted container ID achieves full command injection. Rated CVSS 9.9 with no public exploit identified at time of analysis; EPSS is very low (0.07%) and it is not on CISA KEV.
Command injection in Termix (a self-hosted web-based SSH/server-management platform) before version 2.1.0 lets attackers execute arbitrary OS commands on managed remote SSH hosts. The extractArchive and compressFiles endpoints in file-manager.ts build shell commands using double-quoted strings, which — unlike the single-quote escaping used everywhere else in the file manager — permit $(command) substitution in attacker-controlled input. SSVC classifies exploitation as PoC-stage (publicly available exploit code exists), it is not in CISA KEV, and EPSS is low (0.16%, 37th percentile), indicating no observed widespread exploitation; the flaw is fixed in 2.1.0.
Authentication bypass in Termix (self-hosted SSH web management platform) before version 2.1.0 lets an attacker who knows only a victim's password bypass TOTP two-factor authentication. The /users/login endpoint issues a temporary JWT (temp_token) carrying a pendingTOTP state that should only unlock the second-factor step, but the auth middleware wrongly accepts this token on fully authenticated endpoints, collapsing 2FA into single-factor password authentication for every TOTP-enabled account. Publicly available exploit code exists (SSVC exploitation: poc), though EPSS probability is very low (0.01%, 1st percentile) and there is no evidence of active exploitation.
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary JavaScript by uploading malicious SVG files that bypass content sanitization. When a Termix user previews the crafted file, the payload executes within the application context with full access to sensitive operations. Public exploit code exists and no patch is currently available.
Docker default credentials in Termix server management. PoC and patch available.