Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values. An authenticated low-privileged user can therefore make Termix authenticate to an attacker-controlled SSH server and disclose another user's stored SSH password or private-key material while the victim user's data key is unlocked. This issue is fixed in version 2.3.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-19T21:16:56.697Z",
  "pubdate": "2026-08-19T21:16:56.697Z",
  "executiveSummary": "A credential disclosure vulnerability exists in the Termix web-based server management platform prior to version 2.3.2. The flaw arises from improper access controls and insecure credential handling within the SSH subsystem.\nAuthenticated low-privileged users can exploit this vulnerability to force the Termix application to authenticate against an attacker-controlled SSH server.\nDuring this forced authentication sequence, the application discloses stored SSH passwords or private-key material belonging to other users, provided the victim user's data key is currently unlocked.\nThis impacts the confidentiality of sensitive authentication materials stored within the platform.\nSuccessful exploitation requires authenticated access to the application with low privileges, allowing an attacker to leverage user-controlled parameters in the terminal WebSocket connection to trigger unauthorized credential fallback mechanisms.",
  "technicalDetails": "The vulnerability resides in the SSH host resolution and terminal handling components of Termix, specifically within src/backend/ssh/host-resolver.ts and src/backend/ssh/terminal.ts.\nPrior to version 2.3.2, the terminal WebSocket endpoint accepts a user-controlled parameter designated as hostConfig.id.\nThe resolveHostById function processes this identifier and resolves the targeted host without enforcing proper authorization checks to verify whether the requester owns or holds explicit access to the specified host configuration.\nWhen no explicit credential is shared with the requester during this process, resolveHostById initiates an owner credential fallback mechanism.\nSubsequently, src/backend/ssh/terminal.ts combines these retrieved fallback credentials with attacker-controlled parameters including ip, port, and username values supplied via the WebSocket interface.\nAn authenticated low-privileged attacker can supply a malicious configuration pointing to an attacker-controlled SSH server. When Termix attempts to establish the connection, it presents the retrieved owner credentials to the malicious server.\nThis behavior results in the unauthorized disclosure of sensitive authentication material, such as stored SSH passwords or private keys, belonging to other system users while their data keys are unlocked.\nThe attack vector involves initiating a WebSocket connection to the terminal interface, supplying manipulated hostConfig.id parameters alongside attacker-controlled destination attributes, and capturing the resulting outbound authentication exchange."
}