CVE-2026-79764

Executive Summary

CVE-2026-79764 is a server-side request forgery (SSRF) vulnerability in Termix, a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From version 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. A low-privilege or self-registered account can exfiltrate internal service data and cloud credentials because the endpoint returns the complete fetched JSON response. The issue carries a CVSS score of 7.7 (High) and is fixed in version 2.5.1; no public PoC or exploit code is currently available.

Technical Analysis

The vulnerability resides in the file src/backend/database/routes/homepage-proxy-routes.ts, where the /homepage/proxy endpoint accepts a url query parameter from an authenticated user. According to the NVD description, this parameter is passed directly to http.get or https.get without any destination restrictions. The only validation applied is a new URL syntactic check, which confirms the string parses as a valid URL but does not enforce any allowlist, blocklist, or network-range policy.

Because no destination restrictions exist, an attacker can supply URLs pointing to:

• Loopback addresses (127.0.0.0/8, ::1), reaching services bound only to localhost on the Termix host.
• RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), reaching internal network services otherwise unreachable from outside.
• Link-local addresses (169.254.0.0/16), including the cloud metadata endpoint 169.254.169.254, which commonly exposes instance credentials and configuration.
• Any other routable destination, making the endpoint a general-purpose request forwarder.

The impact is amplified because the endpoint returns the complete fetched JSON response to the caller. This turns the SSRF into a data-exfiltration primitive: the attacker does not need blind timing or out-of-band channels to read the internal response — the server relays the full body back over the same authenticated session. The CVSS vector reflects this: Scope is Changed (S:C) because the vulnerable component (Termix) is being used to affect resources beyond its security scope (internal services and the cloud control plane), and Confidentiality is High (C:H) because full response bodies are returned. Integrity and Availability impacts are None (I:N/A:N) — the primitive is read-oriented per the available description. The attack requires Low privileges (PR:L, any authenticated account, including a self-registered one) and no user interaction (UI:N), over the network (AV:N) with Low complexity (AC:L).

The root cause class is CWE-918 (Server-Side Request Forgery), specifically the missing enforcement of destination policy after URL parsing. Syntactic validation via the URL constructor is insufficient: a syntactically valid URL can still resolve to a prohibited network location, and DNS-based or redirect-based bypasses can further evade naive checks.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Only identifiers and endpoints explicitly named in the description are used.

1. Reconnaissance / target identification. The attacker identifies an internet-exposed (or otherwise reachable) Termix instance running version 2.5.0 (the vulnerable range extends "from 2.5.0 until 2.5.1"). Termix instances are discoverable via web fingerprinting; Shodan-style queries for the product name or page title help enumerate candidate hosts. The attacker confirms the version and locates the /homepage/proxy endpoint exposed by the platform's homepage proxy feature.

2. Triggering the specific flaw. The attacker authenticates — either with a compromised low-privilege credential or by self-registering an account, both of which are sufficient given PR:L. The attacker then issues an HTTP request to /homepage/proxy with a url query parameter set to an internal destination. Because the only check performed is new URL syntactic validation, the server accepts the request and forwards it via http.get or https.get to the attacker-chosen address without applying destination restrictions.

3. Payload / execution at the vulnerability-class level. The payload is simply the crafted url value targeting a sensitive internal address. Candidate targets, per the description, include loopback services, RFC1918 hosts, link-local addresses, and the cloud metadata service (e.g., 169.254.169.254). No code injection or memory corruption is involved — the attack abuses the server's own outbound request capability and the fact that the endpoint returns the complete fetched JSON response to the requester.

4. Post-exploitation impact. The attacker reads the relayed JSON response and extracts internal service data and, where cloud metadata is reachable, cloud credentials. Those credentials can enable lateral movement into cloud infrastructure, privilege escalation, or further data access outside the original Termix host. Because Scope is Changed, the compromise extends beyond Termix to the surrounding network and cloud environment.

Impact Assessment

• Confidentiality: High (C:H). The endpoint returns the complete fetched JSON response, so internal service data and cloud credentials can be exfiltrated by a low-privilege or self-registered user.
• Scope: Changed (S:C). Impact crosses a security boundary: the Termix component is used to access resources (loopback, RFC1918, link-local, cloud metadata) beyond its own authorization scope.
• Integrity / Availability: None (I:N/A:N). The described primitive is read-oriented; no write or denial-of-service impact is specified.
• Business impact. Any organization running Termix 2.5.0 in a cloud or hybrid environment with reachable metadata services faces credential disclosure risk, which can cascade into account takeover and broader cloud compromise. Internet-exposed instances are the highest priority, but internal-only deployments are also at risk from any authenticated insider or compromised low-privilege account.
• Blast radius. Limited to installations in the affected version range (2.5.0 - 2.5.1), but the downstream reach depends on what the Termix host can network-reach. A Termix host with a permissive egress path and reachable cloud metadata service represents the worst case.

Detection Guidance

Sigma Rule

title: Possible SSRF via Termix /homepage/proxy url Parameter
id: 6f2b9c1a-3d4e-4f7a-9b2c-1a2b3c4d5e6f
status: experimental
description: Detects requests to the Termix /homepage/proxy endpoint carrying a url query parameter that targets loopback, RFC1918, link-local, or cloud metadata destinations.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79764
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/homepage/proxy'
  selection_param:
    cs-uri-query|contains:
      - 'url='
  selection_internal_dest:
    cs-uri-query|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
  condition: selection_endpoint and selection_param and selection_internal_dest
falsepositives:
  - Legitimate use of the homepage proxy feature against internal resources (rare)
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule EXPL_CVE_2026_79764_Termix_SSRF
{
    meta:
        author = "valtersit.com"
        description = "Detects CVE-2026-79764 Termix SSRF exploitation attempts or related source artifacts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79764"
        date = "2026-01-01"

    strings:
        $endpoint = "/homepage/proxy" ascii wide
        $file = "homepage-proxy-routes.ts" ascii wide
        $urlparam = "url=" ascii wide
        $meta1 = "169.254.169.254" ascii wide
        $loop = "127.0.0.1" ascii wide
        $localhost = "localhost" ascii wide
        $rfc1918a = "192.168." ascii wide
        $rfc1918b = "172.16." ascii wide
        $rfc1918c = "10.0.0." ascii wide
        $httpget = "http.get" ascii wide
        $httpsget = "https.get" ascii wide

    condition:
        $endpoint or $file or
        (2 of ($urlparam, $meta1, $loop, $localhost, $rfc1918a, $rfc1918b, $rfc1918c, $httpget, $httpsget))
}

Suricata IDS Rule

alert http any any -> any any (msg:"EXPLOIT CVE-2026-79764 Termix /homepage/proxy SSRF Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/homepage/proxy"; http.uri; content:"url="; pcre:"/url=(?:https?%3A%2F%2F|https?:\/\/)?(?:127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.)/iU"; reference:cve,2026-79764; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79764; classtype:web-application-attack; sid:202679764; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=1m
  [ network where http.request.method == "GET"
      and url.path : "/homepage/proxy"
      and url.query : ("*127.0.0.1*" or "*localhost*" or "*169.254.169.254*" or "*192.168*" or "*172.16*" or "*10.*") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| search uri_path="/homepage/proxy" OR url="/homepage/proxy*"
| search (query="*url=*" OR uri_query="*url=*")
| regex field=_raw "(?i)url=([^&\s]*)(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)"
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as source_ips values(user) as users by dest
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-79764,">
  <rule id="2026797" level="12">
    <decoded_as>json</decoded_as>
    <field name="url.path">/homepage/proxy</field>
    <field name="url.query" type="pcre2">(?i)url=([^\s]*)(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)</field>
    <description>CVE-2026-79764: Possible Termix /homepage/proxy SSRF attempt targeting internal destination</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf,cve_2026_79764,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 2.5.1; no vendor advisory, OSV package mapping, workaround, or remediation source is currently tracked in the provided data.

1. Immediate mitigations. Restrict network egress from the Termix host so that outbound requests cannot reach loopback, RFC1918 ranges, link-local addresses, or cloud metadata services (169.254.169.254). Enforce IMDSv2 (session-token-based metadata access) where cloud providers support it to reduce the impact of metadata reads. Where feasible, block or disable the /homepage/proxy endpoint, and restrict the user base allowed to authenticate (limit self-registration, apply least privilege, and audit existing low-privilege accounts). Apply network segmentation so Termix hosts cannot reach sensitive internal services.

2. Patch / upgrade steps. Upgrade Termix from affected versions (2.5.0 - 2.5.1 per the description) to version 2.5.1, which is stated to fix the issue. Verify the deployed version after upgrade and confirm the endpoint now enforces destination restrictions. Because no vendor advisory is currently tracked, validate the fix by re-testing the url parameter behavior against internal destinations in a staging environment.

3. Long-term hardening. Implement and maintain a destination allowlist for any server-side URL-fetching feature, resolving hostnames and validating resolved IPs against prohibited ranges (loopback, RFC1918, link-local, and known metadata addresses) to prevent DNS-rebinding and redirect-based bypasses. Disable or restrict unused proxy/fetch functionality. Enforce outbound egress filtering at the network layer. Monitor /homepage/proxy access logs for internal-address patterns and alert on anomalous low-privilege access to internal resources.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79764
• CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• Cloud metadata SSRF guidance (IMDSv2 and metadata endpoint hardening): https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html

No public exploit code, Nuclei template, or PoC was identified for CVE-2026-79764 at the time of writing. EPSS has not yet assigned a score. The vulnerability is not listed in CISA KEV. No threat actor campaigns or in-the-wild exploitation evidence are available in the provided data.