Critical · published October 2, 2025
🚨 A misconfigured Nginx reverse proxy could let attackers stroll right into your Termix server, bypassing authentication entirely! 🔥 Think of it like a restaurant with a doorman who only checks the ID of the person who makes the reservation, not the actual guests walking in — anyone could slip past unnoticed, including those with harmful intentions. With this vulnerability, an attacker can directly access the /ssh/db/host/internal endpoint, which exposes sensitive stored SSH host information, including addresses, usernames, and passwords. This is absolutely devastating for any organization using versions 1.5.0 and below of the Termix Docker image—it's a treasure trove for malicious actors! 🚨
Think of it like a restaurant with a doorman who only checks the ID of the person who makes the reservation, not the actual guests walking in — anyone could slip past unnoticed, including those with harmful intentions. The vulnerability arises because the backend retrieves the Nginx proxy's IP address instead of the client's IP when using the req.ip method, causing isLocalhost to incorrectly return True, which bypasses any authentication checks.
With this vulnerability, an attacker can directly access the /ssh/db/host/internal endpoint, which exposes sensitive stored SSH host information, including addresses, usernames, and passwords. This is absolutely devastating for any organization using versions 1.5.0 and below of the Termix Docker image—it's a treasure trove for malicious actors! 🚨 Immediate action is crucial! Upgrade your Termix Docker image to version 1.6.0 to close this security gap. If you've built your image using the official Dockerfile or are using reverse proxy, make sure to apply this update right away! You can fix this! Follow the steps to secure your server, and you'll be back in superhero territory in no time! 🦸
| Product | Versions | Fixed in |
|---|---|---|
| termix/termix | ≥ 0.1.1, ≤ 1.6.0 | — |