Executive Summary

This vulnerability is a stored cross-site scripting (XSS) attack in Coolify versions prior to v4.0.0-beta.420.6. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator tries to delete the project or its associated resource, the malicious script executes in the admin's browser context, leading to a full compromise of the Coolify instance.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a full compromise of the Coolify instance. This includes theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers, potentially allowing attackers to control deployments, access sensitive data, and manage servers remotely.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying projects with maliciously crafted names containing embedded JavaScript in Coolify instances prior to v4.0.0-beta.420.6. Since the vulnerability triggers when an administrator interacts with such projects, inspecting project names for suspicious script tags or JavaScript payloads is key. Commands or queries to list projects and their names via Coolify's API or database can help. For example, querying the project list via the Coolify API or directly inspecting the database entries for project names containing <script> tags or suspicious JavaScript code can indicate exploitation attempts or vulnerable projects. Specific commands depend on your deployment but might include API calls or database queries filtering project names for script tags.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Coolify to version v4.0.0-beta.420.6 or later, where the vulnerability is fixed. Additionally, restrict project creation permissions to trusted users only, and audit existing projects for malicious names containing embedded JavaScript. Avoid deleting projects with suspicious names until the system is patched, as deletion triggers the payload execution. Implement monitoring for unusual administrator browser activity and consider isolating administrator sessions until the patch is applied.

Useful 0 Not Useful 0