CVE-2026-53549

Executive Summary

CVE-2026-53549 is a server-side request forgery (SSRF) vulnerability in Termix, a web-based server management platform. Prior to version 2.3.2, an authenticated user can trigger the POST /host/db/proxy/test endpoint with attacker-controlled destination addresses, causing the server to make raw TCP or SOCKS connections to arbitrary hosts and ports, including internal infrastructure. Successful exploitation allows attackers to probe private networks, access cloud metadata services (e.g., credential exposure), and enumerate internal services. The vulnerability carries a CVSS score of 7.7 (High), with no known public exploits or CISA KEV inclusion at the time of reporting.

Technical Analysis

The vulnerability resides in the testProxyConnectivity path of Termix's database proxy testing functionality. The affected endpoint, POST /host/db/proxy/test, accepts three request fields: singleProxy, proxyChain, and testTarget. These fields are processed without validating the destination addresses, enabling an authenticated user to direct the Termix server to initiate outbound connections to any reachable host and port. The testProxyConnectivity path uses raw TCP and SOCKS connections, meaning the server acts as a network proxy for the attacker's chosen targets.

The lack of destination validation permits connections to:

• localhost (127.0.0.1 and other loopback addresses)
• Private network ranges (RFC 1918 addresses, e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Link-local metadata services (e.g., 169.254.169.254 on cloud platforms such as AWS, GCP, and Azure)
• Other infrastructure reachable from the Termix server's network position

The attack mechanism is fundamentally a Server-Side Request Forgery (CWE-918). Importantly, the server's structured connection errors disclose host reachability and timing information, which aids an attacker in mapping the internal network. If the attacker targets cloud metadata endpoints, the server's response can expose credentials used by the underlying cloud infrastructure, leading to credential theft.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) highlights:

• Attack Vector: Network — exploitable remotely
• Privileges Required: Low — requires authenticated access only
• Impact: High confidentiality, no integrity or availability impact — primarily an information disclosure issue
• Scope: Changed — the compromised component (Termix) affects a broader scope (internal infrastructure)

No technical detail regarding the exact implementation functions beyond testProxyConnectivity is available from the NVD description. The attack surface is the authenticated web interface, reachable over HTTP/HTTPS.

Exploitation Scenarios

The exploitation chain for CVE-2026-53549 proceeds as follows:

1) Reconnaissance / Target Identification
An attacker first identifies a public-facing Termix instance (version prior to 2.3.2). This is achievable via internet-wide scanning using search engines or network enumeration tools, looking for the Termix web management interface. Shodan queries such as title:"Termix" or http.title:"Termix" would help discover exposed instances. Once found, the attacker must obtain valid credentials — either by guessing default credentials, phishing a legitimate user, or harvesting leaked credentials from previous breaches.

2) Flaw Trigger
With authenticated access, the attacker crafts a POST request to the /host/db/proxy/test endpoint. The request body includes the fields singleProxy, proxyChain, and testTarget, with testTarget set to an internal address. For example, an attacker might set testTarget to 169.254.169.254 (the cloud metadata service) or to an internal host such as a database server on 10.0.0.5:3306. No destination address validation is performed, so the request is accepted and processed.

3) Payload / Execution Method
The testProxyConnectivity path processes the request by establishing raw TCP or SOCKS connections to the attacker-specified targets. Because the field values are arbitrary, the attacker can specify any IP address, hostname, or port. The connection is initiated by the Termix server, not the attacker's client, which bypasses any network-level restrictions that may otherwise block the attacker from reaching internal resources directly.

4) Post-Exploitation Impact
The structured connection errors returned by the server disclose host reachability and timing information. This allows the attacker to:

• Enumerate live hosts and open ports across internal network ranges (internal port scanning)
• Fingerprint internal services based on connection behavior and error messages
• Access cloud metadata services (e.g., 169.254.169.254) to retrieve instance identity documents, temporary credentials (e.g., AWS access keys, IAM role credentials), and user data
• Exfiltrate these credentials to gain broader access to the cloud environment

The metadata access scenario is particularly critical — a successful request to the cloud metadata service can expose credentials that grant the attacker access to the host's IAM role, enabling lateral movement and data exfiltration across the cloud account.

Note: No public PoC is available. The attack chain is inferred from the vulnerability class (SSRF) and the endpoints described in the NVD advisory. The exact request body schema beyond the three named fields is not disclosed.

Impact Assessment

Business Impact: High. Termix is a server management platform, so instances are likely deployed in environments where the operator (and the connected infrastructure) handles sensitive operations. Successful exploitation exposes internal network topology, service reachability, and potentially cloud credentials. The SSRF can be leveraged to pivot from the Termix server to other internal systems, turning a single compromised account into a foothold for lateral movement.

Affected Systems: All Termix deployments prior to version 2.3.2. This includes any organization using Termix in production without the latest update.

Blast Radius: The scope-changed CVSS component (S:C) indicates the impact extends beyond the Termix server itself to the broader network and cloud environment. The confidentiality impact is high (C:H), meaning the attacker can access information from internal systems and services. No direct integrity or availability impact is declared, but indirect effects (e.g., data theft via exposed credentials) may compound the damage.

CVSS Subscores Analysis:

• Attack Vector: Network (AV:N) — remotely exploitable via the web UI
• Attack Complexity: Low (AC:L) — no special conditions required beyond authentication
• Privileges Required: Low (PR:L) — valid user credentials needed
• User Interaction: None (UI:N) — no victim interaction needed
• Scope: Changed (S:C) — the impacted component (internal network) differs from the vulnerable component (Termix server)

Detection Guidance

Sigma Rule

title: Termix SSRF Exploitation Attempt via /host/db/proxy/test
status: experimental
description: Detects requests to the Termix database proxy test endpoint with destination addresses indicative of SSRF exploitation (internal IPs, metadata services).
author: valtersit.com Threat Intelligence
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: POST
    cs-uri-path: /host/db/proxy/test
  filter_internal:
    - cs-body|contains|all:
        - 'testTarget'
        - '127.0.0.1'
    - cs-body|contains|all:
        - 'testTarget'
        - '169.254.169.254'
    - cs-body|contains|all:
        - 'testTarget'
        - '10.'
    - cs-body|contains|all:
        - 'testTarget'
        - '192.168'
    - cs-body|contains|all:
        - 'testTarget'
        - '172.16'
  condition: selection and not filter_internal
  timeframe: 5m
falsepositives:
  - Legitimate administrative testing of internal database connectivity from Termix console
level: medium

YARA Rule

rule Termix_SSRF_Payloads
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects HTTP payloads targeting Termix /host/db/proxy/test with SSRF indicators"
        date = "2026-02-10"
        reference = "CVE-2026-53549"
    strings:
        $endpoint = "/host/db/proxy/test" ascii wide nocase
        $field1 = "singleProxy" ascii wide nocase
        $field2 = "proxyChain" ascii wide nocase
        $field3 = "testTarget" ascii wide nocase

        $metadata1 = "169.254.169.254" ascii wide
        $metadata2 = "169.254.170.2" ascii wide
        $loopback = "127.0.0.1" ascii wide
        $rfc1918_10 = "10.0." ascii wide
        $rfc1918_172 = "172.1" ascii wide
        $rfc1918_192 = "192.168" ascii wide
    condition:
        all of ($field*) and $endpoint and 1 of ($metadata*, $loopback, $rfc1918_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-53549 Termix SSRF Probing /host/db/proxy/test"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/host/db/proxy/test"; http.request_body; content:"testTarget"; http.client_body; pcre:"/(169\.254\.169\.254|127\.0\.0\.1|10\.[0-9]+\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/i"; classtype:attempted-information-leak; reference:cve,2026-53549; sid:202653549; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where
     destination.port == 80 or destination.port == 443,
     http.request.method == "POST",
     url.path == "/host/db/proxy/test",
     request.body.text contains "testTarget" and
       (request.body.text contains "169.254.169.254" or
        request.body.text contains "127.0.0.1" or
        request.body.text matches ".*10\\.[0-9]+\\.*" or
        request.body.text matches ".*192\\.168\\.*" or
        request.body.text matches ".*172\\.(1[6-9]|2[0-9]|3[0-1])\\..*"
       )
  ]
  [network where
     destination.ip == source.ip or
     destination.ip == "169.254.169.254" or
     cidrMatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="/host/db/proxy/test"
| regex _raw="(?i)(169\.254\.169\.254|127\.0\.0\.1|10\.\d+|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)"
| table _time, clientip, host, uri_path, form_data, status
| sort - _time

Wazuh OSSEC Rule

<group name="termix, ssrf, cve-2026-53549,">
  <rule id="100535" level="12" frequency="3" timeframe="300">
    <if_sid>100002</if_sid> <!-- modify per base web rule -->
    <field name="url">/host/db/proxy/test</field>
    <regex type="pcre2">(?i)(169\.254\.169\.254|127\.0\.0\.1|10\.\d+|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)</regex>
    <description>Termix SSRF exploitation attempt (CVE-2026-53549)</description>
    <group>ssrf, termix, cve-2026-53549,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence has been confirmed from any tracked source at this time. The NVD advisory states the issue is fixed in version 2.3.2, but vendor confirmation and release artifacts have not yet been verified.

1) Immediate Mitigations (implement now):

• Restrict access to the Termix web interface to trusted networks or VPN users only; never expose it directly to the internet
• Enforce strong authentication, including multi-factor authentication (MFA), on all Termix accounts to reduce the likelihood of unauthorized authenticated access
• Implement network-level egress filtering on the Termix server to block outbound connections to RFC 1918 address space, link-local metadata addresses (169.254.0.0/16), and loopback (127.0.0.0/8) from the Termix process
• If metadata service access (169.254.169.254) is critical, consider deploying IMDSv2 (AWS) or enforced token-based metadata access to make credential exfiltration harder
• Deploy a Web Application Firewall (WAF) rule to block POST requests to /host/db/proxy/test that contain internal IP addresses in request fields until the patch is applied

2) Patch / Upgrade Steps:

• Monitor vendor channels for the official release of Termix 2.3.2 or later
• Once the patched version is released, validate the update in a staging environment before production rollout
• After upgrading, verify that the /host/db/proxy/test endpoint performs destination validation and rejects internal or metadata addresses
• If the patched version is not yet available, contact the vendor for an interim hotfix or timeline

3) Long-Term Hardening:

• Implement a comprehensive SSRF prevention strategy in the application: validate and sanitize all user-supplied destination fields against allowlists of permitted IP ranges
• Block loopback and metadata IPs at the network level using firewall rules or security groups
• Apply the principle of least privilege: ensure Termix accounts have the minimum required permissions to perform their functions
• Segment the Termix server on its own network tier with restricted outbound egress, so even a compromised host cannot reach the broader internal network
• Regularly audit Termix logs for anomalous POST requests to database proxy test endpoints
• Subscribe to CVE alerts and vendor advisories to stay informed of patch availability

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-53549 (official CVE record; NVD description used in this report)
2. MITRE ATT&CK Technique T1190 — https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application — mapping for authenticated SSRF exploitation)
3. CWE-918: Server-Side Request Forgery (SSRF) — https://cwe.mitre.org/data/definitions/918.html (vulnerability class reference)
4. OWASP SSRF Prevention Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html (mitigation reference for SSRF class)

Threat Actor Campaigns / In-the-Wild Evidence: No known threat actor campaigns or exploit-in-the-wild evidence has been reported for CVE-2026-53549. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Public exploit code has not been identified; the Nuclei template and exploit code status are both negative. EPSS scoring is not yet available from FIRST.org. Analysts should treat this vulnerability as a high-priority unpatched issue given the low exploitation barrier (low privilege required, network-attack vector) and the potential for cloud credential theft.