Summary
OS command injection in docker (CVE-2026-42454). Successful exploitation can lead to full system takeover. Exploitable via GET /docker/containers/.
Original description
The description as published by the source.
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands executed via ssh2.Client.exec() on remote managed servers without any sanitization or validation. An authenticated attacker can inject arbitrary OS commands by crafting a malicious container ID, achieving Remote Code Execution on any managed server. This issue has been patched in version 2.1.0.
Source: NIST National Vulnerability Database NVD
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
A critical flaw has been discovered in Termix, a server management platform, that allows attackers to execute arbitrary commands on managed servers by exploiting the Docker container management endpoints. This is similar to Heartbleed, where unauthorized access can lead to complete system compromise. It is essential to update to version 2.1.0 immediately to mitigate this risk.
In Termix, Docker container management endpoints interpolate containerId directly into shell commands executed via ssh2.Client.exec(), which allows for OS command injection. Affected versions are <=2.0.0, fixed in 2.1.0. An example of exploitation: GET /docker/containers/<valid-session-id>/$(id>/tmp/pwned)/logs HTTP/1.1. Patch involves validating containerId or using Docker Engine API directly to avoid shell commands.
OS command injection via containerId in Docker management endpoints.
GET/POST/DELETE /docker/containers/:sessionId/:containerId/* endpoints and WebSocket handlers in Termix.
Critical severity, CVSS v3 score 9.9 implying remote execution, no user interaction needed, and potential system compromise.
Upgrade to Termix version 2.1.0 or later.
Validate containerId using regex or use Docker API.
Check logs for unusual containerId values executing commands.
Related past incidents Similar incidents extracted from past CVEs
Similar to Heartbleed in that unauthorized access can lead to significant system control.
Similar RCE in SSH command processing in web applications.
RCE through HTTP request in Apache Flink, similar vector.
If this happens at your company Expected impact per business scenario
攻撃者により顧客データベースへの不正アクセスや改竄が発生する可能性があります。
内部ネットワークに深刻な障害を引き起こし、業務全体が停止するリスクがあります。
クラウド上のリソースが攻撃者に奪取され、データ流出や財務的損失に繋がる可能性があります。
速やかにTermixをバージョン2.1.0にアップデートし、影響を受ける可能性のあるサービスを再評価してください。
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'docker' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
dockerを grep し、稼働しているサービス・バージョンを把握する。 -
2Match against affected range verify
Confirm if version satisfies `<= 2.0.0`Step 1 で見つかったバージョンが影響範囲
<= 2.0.0に該当するか照合。本番で稼働中ならインシデント扱い。 -
3Hunt for indicators of compromise detect
grep 'GET /docker/containers/' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'アクセスログで
GET /docker/containers/への異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。 -
7Post-deployment verification verify
Replay attack against GET /docker/containers/ on staging to confirm patch closes the vectorパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。