Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure reachable from the Termix server. Structured connection errors disclose host reachability and timing information, and successful metadata access can expose cloud credentials. This issue is fixed in version 2.3.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-19T21:16:57.143Z",
  "pubdate": "2026-08-19T21:16:57.143Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability exists in Termix prior to version 2.3.2.\nThe vulnerability affects the POST /host/db/proxy/test endpoint, allowing authenticated users to perform unauthorized network scanning and resource access.\nThe flaw stems from a lack of destination address validation in the singleProxy, proxyChain, and testTarget request fields, which are processed by the testProxyConnectivity path using raw TCP and SOCKS connections.\nImpacts include internal network reconnaissance, local service probing, exposure of link-local metadata services, and potential cloud credential theft.\nExploitation requires authentication on the Termix server.\nRisk implications involve severe compromise of internal infrastructure and cloud environments reachable from the host.",
  "technicalDetails": "The root cause of the vulnerability is the absence of input validation and sanitization for destination addresses supplied to the POST /host/db/proxy/test endpoint.\nSpecifically, the request fields singleProxy, proxyChain, and testTarget accept arbitrary host and port combinations without verifying whether they target internal or external resources.\nThe vulnerable component is the testProxyConnectivity routine, which initiates raw TCP and SOCKS connections based on attacker-supplied parameters.\nAffected versions include all Termix deployments prior to version 2.3.2.\nAuthentication requirements dictate that an attacker must possess valid user credentials to access the vulnerable endpoint.\nThe attack flow proceeds as follows: First, an authenticated user sends a crafted HTTP POST request to the /host/db/proxy/test endpoint. Second, the payload includes malicious values within the singleProxy, proxyChain, or testTarget fields pointing to internal targets such as localhost, private RFC 1918 subnets, or link-local metadata services. Third, the Termix server processes the request via the testProxyConnectivity function and establishes raw TCP or SOCKS connections to the specified infrastructure. Fourth, structured connection errors are returned to the client, disclosing host reachability and timing information. Finally, if the target is a valid metadata service, successful access can expose sensitive data such as cloud credentials.\nPost-exploitation impact encompasses unauthorized access to internal services, lateral movement capabilities, and exfiltration of cloud instance metadata."
}