Authenticated Command Injection in Coolify Prior to 4.0.0-beta.464

Executive Summary

This vulnerability is an authenticated command injection in the CA Certificate management feature of Coolify, an open-source tool for managing servers and applications.

It occurs because the application only validates the certificate format up to the -----END CERTIFICATE----- marker, allowing an attacker to inject malicious content beyond this point.

The injected certificate content is then passed directly to a shell command without proper sanitization, enabling execution of arbitrary commands as the configured SSH user on the managed server.

Since the SSH user typically has root or Docker group privileges, this leads to complete compromise of the managed server and its Docker containers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a complete compromise of the managed server and associated Docker containers.

• An attacker with authenticated access can execute arbitrary commands as the SSH user.
• The attacker can read all files and credentials on the server.
• It allows pivoting to other systems and potential privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if your Coolify instance is running a vulnerable version (prior to 4.0.0-beta.464) and if the CA Certificate management feature is being used.

Since the vulnerability allows command injection via the certificate content, monitoring for unusual or unauthorized command executions by the SSH user associated with Coolify could indicate exploitation attempts.

You can check the installed Coolify version with commands like:

• coolify --version
• docker ps | grep coolify (to identify running containers and their versions)

Additionally, reviewing logs for suspicious commands executed by the SSH user or unusual activity in the CA Certificate management feature may help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Coolify to version 4.0.0-beta.464 or later, where this vulnerability is fixed.

If upgrading immediately is not possible, restrict access to the CA Certificate management feature to trusted users only, as the vulnerability requires authentication.

Also, monitor and audit the commands executed by the SSH user associated with Coolify to detect any suspicious activity.

The fix involves sanitizing the certificate content using openssl_x509_export() after validation to prevent command injection.

Useful 0 Not Useful 0