Insecure Server and Project Access in Coolify Prior to 4.0.0-beta.471

Executive Summary

The vulnerability in Coolify versions prior to 4.0.0-beta.471 allows any authenticated user to access servers and projects that belong to other teams by specifying their IDs directly. This happens because server and project lookups are not properly scoped to the current team, leading to unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized access to servers and projects by specifying IDs directly without proper team scoping. Detection would involve monitoring or testing whether authenticated users can access resources belonging to other teams by manipulating resource IDs.

Since the vulnerability is an Insecure Direct Object Reference (IDOR), one way to detect it is to attempt accessing server or project endpoints with IDs that belong to other teams while authenticated as a user from a different team.

Specific commands or scripts are not provided in the available resources, but a general approach could be to use tools like curl or Postman to send authenticated requests to the server/project lookup endpoints with different resource IDs and observe if access is granted improperly.

• Use curl to send authenticated requests to resource lookup endpoints with IDs from other teams, for example: curl -H "Authorization: Bearer <token>" https://<coolify-server>/api/servers/<other-team-server-id>
• Check server and project lookup API responses for data belonging to other teams when accessed with a user token from a different team.

If unauthorized access is possible, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to servers and projects of other teams within Coolify. An authenticated user could view sensitive information or resources that they should not have access to, potentially leading to data exposure or misuse.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any authenticated user to access servers and projects belonging to other teams by specifying their IDs directly, due to lack of proper scoping to the current team.

Such unauthorized access to data and resources could lead to violations of data protection and privacy regulations such as GDPR and HIPAA, which require strict access controls and data segregation to protect sensitive information.

Therefore, until fixed, this vulnerability potentially compromises compliance with these common standards and regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coolify to version 4.0.0-beta.471 or later, where the issue has been fixed.

Useful 0 Not Useful 0