CVE-2025-59951
BaseFortify
Publication date: 2025-10-01
Last updated on: 2025-10-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| termix | termix | From 0.1.1 (inc) to 1.6.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-348 | The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. |
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in Termix versions 1.5.0 and below when using the official Docker image configured with an Nginx reverse proxy. The backend incorrectly retrieves the proxy's IP address instead of the client's IP when using the req.ip method, causing the isLocalhost check to always return True. This flaw allows unauthenticated access to the /ssh/db/host/internal endpoint, which exposes sensitive SSH host information such as addresses, usernames, and passwords.
How can this vulnerability impact me? :
This vulnerability poses an extremely high security risk because it allows attackers to access sensitive SSH host information without any login or authentication. This could lead to unauthorized access to systems, potential data breaches, and compromise of server management capabilities.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Termix to version 1.6.0 or later, as this version fixes the vulnerability. Additionally, avoid using the official Termix Docker image versions 1.5.0 and below or building your own image using the official dockerfile without the fix. If you use reverse proxy functionality, review and adjust your configuration to prevent the backend from retrieving the proxy's IP instead of the client's IP.