Termix versions before 2.3.2 contain an SSRF vulnerability (CWE-918) in the POST /host/db/proxy/test endpoint. The endpoint accepts the singleProxy, proxyChain, and testTarget fields without validating the destination addresses. The testProxyConnectivity function uses raw TCP and SOCKS connections to attacker-controlled hosts and ports, enabling an authenticated user to probe internal network resources such as localhost, private networks, and cloud metadata services. This can lead to information disclosure including cloud credentials. The vulnerability is addressed in Termix version 2.3.2.

An authenticated attacker can leverage this SSRF vulnerability to scan internal network resources and access sensitive infrastructure such as cloud metadata services. Successful exploitation can disclose cloud credentials, which may lead to further compromise. The vulnerability does not impact confidentiality of the Termix server itself but exposes internal network information and potentially sensitive cloud credentials. There is no indication of impact on integrity or availability.

Upgrade Termix to version 2.3.2 or later where this SSRF vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Since this is not a cloud service, remediation depends on applying the official fix.