Summary
A critical OS command injection vulnerability in Termix allows an authenticated administrator to place attacker-controlled domain or email values into an ACME certificate request. When these values are interpolated into a shell command, shell metacharacters may execute arbitrary operating-system commands with the privileges of the Termix backend process.
Affected context
The vulnerability occurs in Termix ACME SSL certificate request handling when administrator-controlled domain or email settings are later included in a certbot command. Both HTTP webroot and DNS Cloudflare challenge workflows may be affected when values are passed through shell execution without robust argument separation or trusted-value enforcement.
Exploit preconditions
- Attack surface: Authenticated web API endpoints for ACME SSL settings and certificate requests
- Required access: Termix administrator privileges sufficient to modify ACME SSL settings
- Trigger point: Certificate issuance through the ACME SSL request workflow
- Why exploitation is possible: User-controlled values are interpolated into a
/bin/sh -ccommand and protected only by double quotes, which do not reliably prevent shell metacharacter interpretation
Why this happens
The underlying flaw is command construction from untrusted input. Termix passes administrator-controlled domain and email values to child_process.execSync, causing the command to be interpreted by a shell rather than treating each value as an isolated argument. Shell metacharacters can therefore alter command behavior or introduce additional commands, mapping to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- Arbitrary operating-system commands may execute as the Termix backend process
- Termix databases and application data could be exposed or altered
- Process secrets and stored credentials could be compromised
- The attacker could gain network reachability available to the backend
- The host or connected infrastructure could be used for lateral movement
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from application-controlled command execution and reducing trust in administrative configuration values.
Common defensive patterns include:
- Prefer direct process-spawning APIs that pass arguments separately instead of invoking a shell
- Apply strict allowlists and schema validation to domain, email, DNS, and certificate parameters
- Treat values from authenticated administrators as untrusted at command boundaries
- Avoid dynamically assembling commands from strings
- Run certificate-management workflows with minimal operating-system privileges and restricted filesystem and network access
- Keep credentials and process secrets outside the backend process environment where practical
- Enforce authorization, audit logging, and change controls for certificate settings
How teams detect issues like this
Organizations can look for command-injection risks through:
- Static analysis rules identifying
execSync, shell execution, and string interpolation involving request or database values - Code review checks for commands assembled through concatenation, template literals, or quoted user input
- Tests that verify metacharacters are treated as data and cannot alter process arguments
- Runtime monitoring for unexpected child processes, shell invocation, certificate-tool execution, or unusual outbound connections
- Policy enforcement requiring argument-array process APIs and forbidding shell execution for untrusted values
- Review of ACME configuration changes and certificate-request audit events
