Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern.
An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Низкая
Легко эксплуатировать
Нужны права
Высокие
Нужны права администратора
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Низкое
Частичная утечка данных
Целостность
Низкое
Частичная модификация данных
Доступность
Низкое
Частичное нарушение работы
Строка CVSS v3.1
Тип уязвимости (CWE)
Уязвимые продукты
termix-ssh:termix
Ссылки 5
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx
https://github.com/Termix-SSH/Termix/pull/1067
https://github.com/Termix-SSH/Termix/pull/1067
https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1…
https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879…
https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879bbede
https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag
https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag