Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values without checking that either record belongs to the requesting user. In src/backend/database/routes/credentials.ts, differential errors reveal whether credential and host records exist and disclose each record's authType value.
Properly encrypted passwords and keys are not disclosed, but a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. This issue is fixed in version 2.5.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
termix-ssh:termix
References 6
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-w4cf-69fj-g96f
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-w4cf-69fj-g96f
https://github.com/Termix-SSH/Termix/pull/1067
https://github.com/Termix-SSH/Termix/pull/1067
https://github.com/Termix-SSH/Termix/commit/b0598294a6aeed866f51ce58067f43c1d75…
https://github.com/Termix-SSH/Termix/commit/b0598294a6aeed866f51ce58067f43c1d751c7a6
https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1…
https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag
https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag
https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8
134c704f-9b21-4f2e-91b3-4a467353bcc0