Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped lookup can resolve the host with the owner's context and return the owner's plaintext credential, allowing any authenticated user with a valid JWT to enumerate sequential hosts.id values and retrieve SSH or sudo passwords belonging to other users. The disclosed credentials can then be used to access and control managed systems outside the Termix instance. This issue is fixed in version 2.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-19T21:16:57.000Z",
  "pubdate": "2026-08-19T21:16:57.000Z",
  "executiveSummary": "A broken object level authorization (BOLA) vulnerability exists in the Termix web-based server management platform prior to version 2.6.1.\nThe vulnerability affects the GET /host/db/host/:id/password endpoint within src/backend/database/routes/host.ts, allowing authenticated users to retrieve plaintext SSH and sudo passwords belonging to other users.\nThe primary impact is the unauthorized exposure of sensitive administrative credentials, enabling attackers to compromise managed systems outside the immediate Termix instance scope.\nThe risk implication is critical as it completely compromises the confidentiality and integrity boundaries separating multi-tenant hosts within the platform.\nAttacker capabilities require a valid JSON Web Token (JWT) authenticating a standard user, coupled with the ability to perform sequential enumeration of numeric host IDs.\nNo elevated privileges are required to initiate the attack beyond standard application authentication, and exploitation can be executed remotely via HTTP requests to the exposed API endpoint.",
  "technicalDetails": "The root cause of the vulnerability resides in flawed authorization logic within the credential resolution routine implemented in src/backend/database/routes/host.ts.\nSpecifically, the GET /host/db/host/:id/password endpoint accepts an authenticated user's numeric host ID along with either the field=password or field=sudoPassword query parameters.\nThe backend fails to enforce proper host ownership validation during the lookup process. When a requester-scoped lookup fails against the current user context, the application improperly falls back to resolving the host using the owner's context.\nThis fallback mechanism bypasses tenancy checks and returns the plaintext credential associated with the requested host identifier.\nThe vulnerable component is the host database routing logic handling credential retrieval endpoints in versions prior to 2.6.1.\nAuthentication requirements dictate that the attacker must possess a valid user session or JWT to interact with the API, while privilege requirements are minimal, needing only standard user access.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts an HTTP GET request targeting the endpoint /host/db/host/:id/password.\nSecond, the attacker appends query parameters specifying the target credential type, such as field=password or field=sudoPassword.\nThird, the attacker systematically iterates through sequential numeric host.id values, bypassing authorization checks due to the flawed lookup implementation.\nFourth, the application returns the plaintext SSH or sudo credentials belonging to arbitrary users and isolated systems.\nPost-exploitation impact includes the reuse of harvested plaintext credentials to directly access, manage, and pivot across external systems under management, leading to total infrastructure compromise outside the Termix instance."
}