Authenticated RCE in Coolify via Nixpacks Build Parameters

Executive Summary

This vulnerability exists in Coolify, an open-source tool for managing servers, applications, and databases. Before version 4.0.0-beta.470, there was a critical security flaw in how Coolify handled user-defined build parameters for the Nixpacks build pack.

Specifically, the install_command provided by a user was directly concatenated into a shell command string that runs on the deployment host during the build phase. Because of this, an attacker could manipulate the install_command to escape the intended build context and execute arbitrary commands on the host with elevated privileges.

This type of vulnerability is known as an Authenticated Host Remote Code Execution (RCE) vulnerability and was fixed in version 4.0.0-beta.470.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Coolify installation is running a vulnerable version (prior to 4.0.0-beta.470) and by inspecting project configurations for malicious or suspicious entries in the user-defined build parameters, specifically the install_command field.

Since the vulnerability involves command injection via the install_command parameter during deployment, you can look for unusual or unexpected shell commands being executed on the host during build phases.

Suggested commands to detect potential exploitation or presence of malicious payloads include:

• Check the Coolify version installed: `coolify --version` or check the deployment environment for the version number.
• Search for suspicious install_command entries in project configurations or deployment files, for example by grepping for suspicious characters or command injection patterns: `grep -r 'install_command' /path/to/coolify/projects | grep -E '[;"\'`
• Monitor running processes or recent shell commands executed during deployment for unexpected network connections or reverse shells, e.g., `ps aux | grep bash` or `netstat -anp | grep ESTABLISHED` to detect unusual outbound connections.
• Check logs for deployment commands or errors that might indicate command injection attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with authenticated access to execute arbitrary commands on the deployment host with host-level privileges.

The impact includes potential full system compromise, unauthorized access to sensitive data, disruption of services, and the ability to install malware or create persistent backdoors.

Because the attacker can execute commands at the host level, the security and integrity of the entire system and any applications or data it manages are at risk.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated attacker to execute arbitrary commands with host-level privileges, potentially leading to unauthorized access to sensitive data and system compromise.

Such unauthorized access and potential data breaches could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.

However, the provided information does not explicitly discuss the direct effects on compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coolify to version 4.0.0-beta.470 or later, where the issue has been fixed.

Useful 0 Not Useful 0