CVE-2026-53545

Executive Summary

CVE-2026-53545 is a critical OS command injection vulnerability (CWE-78) in Termix, a web-based server management platform offering SSH terminal, tunneling, and file editing capabilities. The flaw resides in the tunnel teardown path (DELETE /ssh/tunnel/disconnect/:tunnelName) in src/backend/ssh/tunnel.ts, where user-controlled fields are interpolated into pkill -f shell commands without proper sanitization. An authenticated attacker with the ability to modify a tunnel host field can achieve arbitrary command execution on the source SSH host with the privileges of the connected SSH account. The vulnerability carries a CVSS score of 9.8 (Critical) and is fixed in version 2.3.2.

Technical Analysis

The vulnerability exists in the Termix backend's SSH tunnel management module, specifically in the teardown (disconnect) path located in src/backend/ssh/tunnel.ts. When a user requests the deletion or disconnection of an SSH tunnel via the DELETE /ssh/tunnel/disconnect/:tunnelName endpoint, the application constructs a shell command to kill the tunnel process.

The NVD description identifies four specific data fields that are interpolated into the command line:

1. endpointPort — the remote endpoint's TCP port
2. sourcePort — the local listening port
3. endpointUsername — the SSH username used for the tunnel connection
4. endpointIP — the remote endpoint's IP address or hostname

These values are embedded into a single-quoted pkill -f pattern. The vulnerability class is OS command injection (CWE-78) via shell metacharacter injection. Because the fields are wrapped in single quotes ('), an attacker who can inject a single quote character can terminate the quoted string and append arbitrary shell commands that execute immediately after the pkill command completes — provided the shell chain is constructed with appropriate operators.

The attack surface requires the attacker to be authenticated on the Termix platform and to have the ability to edit a tunnel host field. This implies that the attacker must have at least a standard user account with permissions to manage or modify SSH tunnel configurations. The affected fields (endpointPort, sourcePort, endpointUsername, endpointIP) are tunnel configuration parameters, but the NVD description specifically notes that the attack is feasible by injecting a single quote into a tunnel host field.

The injection vector is not a traditional input-validation failure at the HTTP layer; rather, it is a failure to sanitize or escape values before embedding them in a shell command string. The use of pkill -f is notable because the -f flag matches against the full command line of processes, making the pattern matching broader and increasing the likelihood of process termination side effects during exploitation.

The command executes on the source SSH host — the machine where the SSH tunnel originates. The execution context is the privileges of the connected SSH account, meaning the attacker gains command execution as whatever user the SSH session was established as. If an administrator connects a tunnel using a high-privileged account (e.g., root), the injected commands inherit those privileges.

Exploitation Scenarios

Step 1: Reconnaissance / Target Identification

An attacker first identifies a target Termix installation. Using Shodan or similar search engines, the attacker searches for exposed Termix web panels (e.g., HTTP responses containing Termix-specific headers, login pages, or known default ports). The attacker also enumerates the application version by checking the login page footer, API responses, or static asset versions to confirm the installation is prior to 2.3.2.

Step 2: Authentication and Tunnel Access

The attacker must authenticate to the Termix platform. This requires valid credentials. Attack vectors include:

• Compromised credentials via phishing or credential stuffing
• Default credentials (if the platform is poorly configured)
• Existing low-privilege accounts within an organization that have tunnel-edit permissions

Once authenticated, the attacker navigates to the SSH tunnel management interface and either:

• Creates a new tunnel, or
• Edits an existing tunnel whose host field they control

Step 3: Payload Injection and Trigger

The attacker modifies the tunnel's host field (specifically endpointIP or endpointUsername, as these are string fields) to include a single quote (') followed by a shell command. A typical injection payload at the vulnerability-class level would be:

' ; <malicious_command> ; '

When the tunnel is disconnected (via the DELETE /ssh/tunnel/disconnect/:tunnelName endpoint), the backend constructs a pkill -f command with the attacker-controlled value embedded inside single quotes. The injected single quote terminates the string, allowing the appended command to be interpreted by the shell as a separate command.

Example of the constructed command (hypothetical illustration — do not treat as exact implementation):

pkill -f 'ssh -L <sourcePort>:<endpointIP>:<endpointPort> <endpointUsername>@...'

If endpointIP contains '; touch /tmp/pwned; ', the shell interprets this as:

pkill -f 'ssh -L <sourcePort>:'; touch /tmp/pwned; ':<endpointPort> <endpointUsername>@...'

The injected touch /tmp/pwned executes immediately.

Step 4: Post-Exploitation Impact

Successful exploitation grants the attacker arbitrary command execution on the source SSH host with the privileges of the SSH account used for the tunnel. Impact varies by account privileges:

• Low-privilege SSH account: Data exfiltration, lateral movement within the host, persistence via cron jobs or user-level startup scripts
• Root/high-privilege SSH account: Full host compromise, credential harvesting, network pivoting, installation of backdoors

The command injection executes in the context of the Termix backend process or the SSH client process, depending on the implementation. In either case, the execution privileges mirror the SSH account's permissions.

Note: No public PoC is available at the time of writing. This attack chain is inferred from the vulnerability class (CWE-78 OS command injection) and the CNA description's explicit mention of single-quote termination and shell command execution.

Impact Assessment

CVSS Score: 9.8 (Critical) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The CVSS vector indicates:

• Attack Vector: Network — Exploitable remotely
• Attack Complexity: Low — No special conditions required; standard request sequence
• Privileges Required: None — Despite the NVD description noting "authenticated user," the CVSS scoring assumes no privileges (likely because default tunnel creation may not require separate authorization, or the tunnel-editing permission is granted to all authenticated users)
• User Interaction: None — No victim interaction needed
• Scope: Unchanged — The compromised component is the SSH host itself
• Confidentiality / Integrity / Availability Impact: High — Full compromise of the affected host

Business Impact:

1. Confidentiality Breach: Attackers can read any file accessible to the SSH account, including credentials, application configs, and sensitive data.
2. Integrity Compromise: Attackers can modify data on the SSH host, plant backdoors, and alter system binaries.
3. Availability Loss: Attackers can terminate processes, delete data, or render the host unusable.
4. Lateral Movement: The SSH host is likely part of a broader network; compromise enables pivoting to other systems.
5. Supply Chain/Audit Risk: If the SSH host is a jump server or bastion, compromising it exposes all traffic passing through.

Affected Systems:

• Termix versions prior to 2.3.2
• Any host running the Termix backend (src/backend/ssh/tunnel.ts)
• All SSH tunnel endpoints managed by a vulnerable Termix instance

Blast Radius: The blast radius extends beyond the Termix platform itself. Since the vulnerable code executes pkill on the source SSH host, the attack impacts the host's operating system and all associated services. In a typical deployment where Termix connects to production servers, the blast radius includes those production servers.

Detection Guidance

Sigma Rule

title: Termix SSH Tunnel Command Injection (CVE-2026-53545)
id: 9f4a2c8e-5b3d-4f6a-9c1e-7d8b2a4f6c8e
status: experimental
description: Detects HTTP requests to Termix tunnel disconnect endpoint with potential command injection payloads
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: DELETE
        http.url|contains|all:
            - '/ssh/tunnel/disconnect/'
        http.url|contains:
            - '%27'
            - '%3B'
            - ';'
            - '|'
            - '&&'
            - '||'
            - '$('
            - '`'
    condition: selection
fields:
    - src.ip
    - http.url
    - http.user_agent
falsepositives:
    - Legitimate tunnel names containing special characters (rare)
level: high

YARA Rule

rule TERMIX_TUNNEL_CMDI_CVE_2026_53545 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects shell injection payloads targeting Termix SSH tunnel disconnect endpoint"
        cve = "CVE-2026-53545"
        date = "2026-02-15"
        score = 90
    strings:
        $a = "/ssh/tunnel/disconnect/" ascii wide
        $b = "endpointPort" ascii wide
        $c = "sourcePort" ascii wide
        $d = "endpointUsername" ascii wide
        $e = "endpointIP" ascii wide
        $f = "pkill -f" ascii wide
        $g2 = "' ;" ascii wide
        $h = "$(" ascii wide
        $i = "`" ascii wide
        $j = "&&" ascii wide
    condition:
        (uint16(0) == 0x5B7B or filesize < 10KB) and
        (any of ($a, $b, $c, $d, $e)) and
        ($f) and
        (any of ($g2, $h, $i, $j))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"TERMIX SSH Tunnel Command Injection Attempt (CVE-2026-53545)";
    flow:to_server,established;
    http.method;
    content:"DELETE";
    http.uri;
    content:"/ssh/tunnel/disconnect/";
    http.uri;
    content:"%27";
    http.uri;
    content:"%3B";
    distance:0;
    classtype:attempted-admin;
    reference:cve,CVE-2026-53545;
    sid:10534501;
    rev:1;
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.action == "connection_established" and destination.port == 443 ]
  [ http where
      request.method == "DELETE" and
      url.path like "/ssh/tunnel/disconnect/*" and
      wildcard(url.query, "*%27*") or
      wildcard(url.path, "*%27*")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="DELETE"
| where uri_path="/ssh/tunnel/disconnect/*"
| regex uri_path="(%27|%3B|;|&&|\|\||\$\(|`)"
| eval threat="Termix SSH Tunnel Command Injection (CVE-2026-53545)"
| table _time, method, uri_path, src_ip, user_agent, status
| sort - _time

Wazuh OSSEC Rule

<group name="termix,cve-2026-53545,">
    <rule id="105345" level="15">
        <decoded>DELETE</decoded>
        <match>/ssh/tunnel/disconnect/</match>
        <regex>%27|%3B|;|&&|\|\||\$\(|`</regex>
        <description>Termix SSH Tunnel command injection attempt (CVE-2026-53545)</description>
        <group>attack.t1203,</group>
        <mitre>
            <id>T1203</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch is currently available beyond the version 2.3.2 fix referenced in the NVD description. No official security advisory URLs or patch announcements have been confirmed from the Termix project. The absence of a written advisory increases exploitation risk — organizations must assume they are vulnerable until upgraded.

1. Immediate Mitigations (Zero-Day Response)

These measures reduce risk while awaiting patch deployment:

• Restrict Access to Termix: Place the Termix platform behind a VPN or bastion host. Do not expose it directly to the internet.
• Enforce MFA: Require multi-factor authentication for all Termix accounts to reduce the likelihood of credential compromise.
• Restrict Tunnel Editing Permissions: If the platform supports role-based access control, limit tunnel-creation and tunnel-editing privileges to a small group of administrators.
• Monitor Tunnel Disconnect Activity: Implement the detection rules above in your SIEM/IDS to alert on anomalous DELETE /ssh/tunnel/disconnect/ requests.
• Network Segmentation: Isolate the Termix host from production SSH targets. This limits the blast radius even if command injection occurs.

2. Patch / Upgrade Steps

1. Upgrade Termix to Version 2.3.2 or Later — The NVD description confirms this version addresses the vulnerability.
2. Validate Upgrade Integrity: Verify the downloaded package checksum against a trusted source before installation.
3. Test in a Staging Environment: Before production rollout, verify that the upgrade does not break existing tunnel configurations or SSH connections.
4. Restart Services Post-Upgrade: Ensure the backend service fully restarts and no stale processes remain.

3. Long-Term Hardening

• Adopt Least-Privilege SSH Accounts: Ensure that SSH accounts used by Termix tunnels operate with the minimum privileges required. Avoid root accounts; create dedicated tunnel users.
• Input Validation: After upgrading, review the vendor's fix to confirm that all interpolated fields (endpointPort, sourcePort, endpointUsername, endpointIP) are properly escaped or parameterized before inclusion in shell commands.
• Hash/Key-Based Auth: Use SSH key authentication instead of passwords for tunnel connections to reduce credential exposure.
• Regular Security Audits: Schedule periodic review of tunnel configurations for unexpected host fields or suspicious patterns.
• Stay Informed: Monitor the Termix project's release notes and security advisories for additional patches or guidance.

If upgrade is not immediately possible, consider discontinuing SSH tunnel features in Termix and using OS-native SSH tunneling managed directly by administrators, which avoids the vulnerable code path entirely.

References

1. NVD Entry: CVE-2026-53545 — National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-53545
2. Termix Project (vendor): https://github.com/termix/termix (returned 404 — verify manually) — (verify release notes for version 2.3.2; direct advisory not located)
3. MITRE ATT&CK: T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
4. CWE-78: OS Command Injection — https://cwe.mitre.org/data/definitions/78.html
5. CISA KEV: Not listed (as of report date)

Threat Actor Activity / Exploit-in-the-Wild Evidence: No public evidence of exploitation in the wild has been reported at the time of writing. No known threat actor campaigns have been associated with this CVE. The PoC status is Private — no public exploit code or Nuclei template exists currently. The "UNPATCHED" patch confidence score reflects the absence of a formal vendor advisory beyond the fix-version reference in the NVD description.