Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in the Termix server management platform could allow an authenticated, low-privileged user to gain access to sensitive SSH credentials, such as stored passwords or private keys, belonging to other users. This could occur when Termix is tricked into authenticating to an attacker-controlled server using another user's credentials. The main concern is confirming relevance and exposure to this type of platform.
- Low-privilege users can steal SSH credentials.
- It affects server management, enabling credential theft.
- Confirm if your organization uses this platform.
Attack Path
How an attacker could exploit the issue
An attacker with low-privileged access to Termix can manipulate the terminal WebSocket to resolve a host configuration without proper ownership checks. By providing a user-controlled ID, the attacker can trick Termix into using fallback credentials and then combine these with attacker-supplied connection details. This allows the attacker to impersonate another user's SSH connection, potentially exposing sensitive credentials or private keys.
- Requires authenticated low-privileged access.
- Triggers vulnerability via host ID in WebSocket.
- Risk of credential or private key disclosure.
Live Threat
Current exploitation, exposure, and threat context
A low-privileged authenticated user could exploit this vulnerability to cause Termix to authenticate to an attacker-controlled SSH server. This could lead to the disclosure of another user's stored SSH password or private key material when that user's data key is unlocked.
- Stored SSH credentials and private keys.
- Low-privilege user connects to attacker server.
- Disclosure of sensitive user credentials.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Termix platform's authentication vulnerability requires the application owner or platform team to identify all instances of Termix, particularly those exposed externally, and confirm their business criticality. Coordination with the vendor and potentially network or security teams will be necessary for remediation planning and execution, especially for instances that cannot be immediately updated.
- Application or platform owners should lead.
- Verify all Termix deployments and exposure.
- Plan remediation based on business impact.
