Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In src/backend/database/routes/homepage-proxy-routes.ts, new URL performs only syntactic validation, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. The endpoint returns the complete fetched JSON response, so a low-privilege or self-registered account can exfiltrate internal service data and cloud credentials. This issue is fixed in version 2.5.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Termix-SSH Termix
>= 2.5.0, < 2.5.1affected
References
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-mwr3-35ph-pjqg ↗
- https://github.com/Termix-SSH/Termix/pull/1067 ↗
- https://github.com/Termix-SSH/Termix/commit/4b2a60a854281d0e12e7c9bcde71854a81999ea0 ↗
- https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e ↗
- https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag ↗