CVE-2025-59951

The Termix application uses the req.ip method to determine whether a request originates from the local host — if so, the isLocalhost function returns True and access to protected endpoints is granted without authentication. When the platform runs behind Nginx acting as a reverse proxy (as in the official Docker image), the backend sees the IP address of the proxy itself instead of the actual client address, causing isLocalhost to always evaluate to True. A remote attacker without any credentials can directly invoke the /ssh/db/host/internal endpoint and download the complete database of saved SSH connections along with passwords. The vulnerability results from incorrect access control (CWE-284), reliance on unverified IP headers (CWE-348), and lack of verification of request origin authenticity (CWE-345).

An unauthenticated attacker can gain full access to SSH data stored on the server — host addresses, usernames, and passwords — which consequently enables takeover of all servers managed by the Termix platform.

Termix should be updated to version 1.6.0 where the issue has been fixed. As a temporary workaround, it is recommended to restrict network access to the /ssh/db/host/internal endpoint at the firewall or reverse proxy configuration level to only trusted IP addresses.

Termix versions 1.5.0 and earlier — affects users using the official Termix Docker image, building their own image from the official Dockerfile, or using reverse proxy functionality.