Executive Summary

This vulnerability in Coolify versions prior to v4.0.0-beta.420.7 allows authenticated users with low-level member privileges to inject arbitrary shell commands through the Git Repository field during project creation. By submitting a specially crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, potentially leading to full server compromise.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to full server compromise because an attacker can execute arbitrary commands on the host system. This means unauthorized control over the server, potentially allowing data theft, service disruption, or further attacks within the network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update Coolify to version v4.0.0-beta.420.7 or later, as this release includes critical security fixes addressing remote code execution issues. Applying this update will prevent attackers from exploiting the command injection vulnerability in the Git Repository field during project creation. [1]

Useful 0 Not Useful 0