Termix’s POST /host/db/proxy/test endpoint accepts proxy configuration parameters without validating destination addresses, allowing an authenticated user to open raw TCP or SOCKS connections to any host and port reachable from the Termix server. This enables the user to probe localhost, private networks, and cloud metadata services, with error messages revealing reachability and timing information. Successful access to metadata endpoints can expose cloud credentials, while arbitrary internal hosts can be contacted, making it a classic SSRF flaw (CWE‑918).

The vulnerability affects Termix server‑management platform versions prior to 2.3.2. Any deployment running an older release is susceptible; the issue is fixed in the 2.3.2 release.

The CVSS score of 7.7 indicates high severity, but the EPSS score is not available and it is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated session; the attack vector is a Server‑Side Request Forgery via the proxy test endpoint. Once authenticated, an attacker can execute arbitrary connectivity tests to internal hosts, glean metadata, and potentially exfiltrate credentials from cloud environments.