Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern.
An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
termix-ssh:termix
References 5
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx
https://github.com/Termix-SSH/Termix/pull/1067
https://github.com/Termix-SSH/Termix/pull/1067
https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1…
https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879…
https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879bbede
https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag
https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag