Summary
The GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell.
Details
The vulnerable handler receives sessionId and path from the query string, applies only double-quote escaping, and then builds a shell command using user-controlled input:
const escapedPath = expandPath.replace(/"/g, '\\"');
const command = `echo "${escapedPath}"`;
sshConn.client.exec(command, ...);Command substitution remains active inside double quotes in shell. As a result, escaping only " does not neutralize payloads such as $(id), which are still evaluated by the remote shell before echo processes the value.
PoC
Request sent:
GET /ssh/file_manager/ssh/resolvePath?sessionId=1&path=x%24(id) HTTP/1.1
Host: 192.168.1.26:8080
Referer: http://192.168.1.26:8080/
Cookie: [redacted]
Accept: application/json
Observed response:
{"resolvedPath":"xuid=0(root) gid=0(root) groups=0(root)"}Impact
Any authenticated user with access to File Manager can execute arbitrary commands on the remote host associated with the vulnerable SSH session.
Additionally, the impact is further amplified by a separate Broken Access Control issue related to sessionId. If an attacker replaces the sessionId with the active session identifier of another user, the same command injection can be redirected toward that user’s remote VPS. In that scenario, the issue no longer affects only the attacker’s own session and instead enables command execution against third-party remote infrastructure within the same Termix instance.
Summary
The GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell.
Details
The vulnerable handler receives sessionId and path from the query string, applies only double-quote escaping, and then builds a shell command using user-controlled input:
Command substitution remains active inside double quotes in shell. As a result, escaping only " does not neutralize payloads such as $(id), which are still evaluated by the remote shell before echo processes the value.
PoC
Request sent:
Observed response:
{"resolvedPath":"xuid=0(root) gid=0(root) groups=0(root)"}Impact
Any authenticated user with access to File Manager can execute arbitrary commands on the remote host associated with the vulnerable SSH session.
Additionally, the impact is further amplified by a separate Broken Access Control issue related to sessionId. If an attacker replaces the sessionId with the active session identifier of another user, the same command injection can be redirected toward that user’s remote VPS. In that scenario, the issue no longer affects only the attacker’s own session and instead enables command execution against third-party remote infrastructure within the same Termix instance.