Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In src/backend/database/routes/homepage-proxy-routes.ts, new URL performs only syntactic validation, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations.
The endpoint returns the complete fetched JSON response, so a low-privilege or self-registered account can exfiltrate internal service data and cloud credentials. This issue is fixed in version 2.5.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 5
https://github.com/Termix-SSH/Termix/commit/4b2a60a854281d0e12e7c9bcde71854a819…
security-advisories@github.com
https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1…
security-advisories@github.com
https://github.com/Termix-SSH/Termix/pull/1067
security-advisories@github.com
https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag
security-advisories@github.com
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-mwr3-35ph-pjqg
security-advisories@github.com