Is SSHGate ssh client and terminal emulator safe?

Medium risk

SSHGate sends the address of every .html or .xml page you open to redcoolmedia.net.

A background script watches page navigations on all sites and, for addresses ending in .html or .xml, sends the address (query string removed, hex-encoded) to www.redcoolmedia.net along with a per-install ID. If the server replies with a particular code, the extension opens a new tab on the vendor's site with the visited address included. This is unrelated to the SSH client function, and the popup has an opt-out checkbox.

RedCoolMediav1.4.3Firefox Add-ons
51Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SSH client sends hex-encoded .html and .xml page URLs to redcoolmedia.net

Code analysis shows pages ending in .html or .xml are reported to www.redcoolmedia.net as hex-encoded URLs without the query string.

A server reply can open a new tab.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a web page whose address ends in .html or .xml.

Any website matches, over http or https.

The extension did this

The extension sends the page address, hex-encoded, to www.redcoolmedia.net.

The query string is removed first.

The code that does this

Navigation listener and gating in web.js

Readable version

web.js xnav() request and server-driven tab

web.js
let responsecheck = await fetch('https://www.redcoolmedia.net/api/chk-sshgateff.php?dx=' + d1x + '&url=' + bin2hex(g3x) + '&hex=1');if (responsecheck.status === 200) {    let d2check = await responsecheck.text();    if ( d2check.indexOf("OKOKOK") !== -1 ) {        await seredtd(d2check.substring(0,2));        var newURL = 'https://www.redcoolmedia.net/api/app-sshgate.php?url=' + bin2hex(g3x);        chrome.tabs.create({ url: newURL });    }}
Query parameters sent to the vendor
  • Visited page address
    68747470733a2f2f6578616d706c652e636f6d2f646f63732f696e6465782e68746d6c

    The page you opened, without its query string, hex-encoded.

  • Day of month
    09

    Two-digit day used by the extension to limit how often it checks.

  • Hex flag
    1

    Tells the server the URL is hex-encoded.

Where the page addresses go
    • www.redcoolmedia.net

    Receives hex-encoded URLs; reply may trigger a new tab on app-sshgate.php. Same family as the OffiDocs/RedcoolMedia extensions.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.4.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed SSHGate ssh client and terminal emulator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.redcoolmedia.net

    SSHGate ssh client and terminal emulator sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-822998