Termix ACME SSL Settings Command Injection Vulnerability

Termix, a web-based server management platform, is affected by a command injection vulnerability in its ACME SSL settings. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request.

In src/backend/database/routes/acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process.

• Affected versions: 2.4.1 through 2.5.1
• Both HTTP webroot and DNS Cloudflare challenge modes are affected
• Compromise exposes Termix databases, process secrets, stored credentials, and network reachability
• Fixed in version 2.5.1