Insufficient Authorization in Coolify Prior to 4.0.0-beta.466

Executive Summary

The vulnerability in Coolify versions prior to 4.0.0-beta.466 involves the mutating API validation endpoints being protected only by read permissions. This means that API tokens with read-only scope can perform state-changing operations, such as validating cloud tokens and servers, which should normally require higher privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves read-scoped API tokens being able to perform state-changing operations on certain Coolify API endpoints that should require write permissions.

To detect if your system is vulnerable, you can check the version of Coolify you are running. Versions prior to 4.0.0-beta.466 are affected.

You can also test whether read-scoped API tokens can perform mutation operations on the following endpoints:

• POST /api/v1/projects
• POST /api/v1/servers
• POST /api/v1/cloud-tokens/{uuid}/validate
• GET /api/v1/servers/{uuid}/validate

If a read-scoped token can successfully perform state-changing operations on these endpoints, your system is vulnerable.

Suggested commands to test this could include using curl with a read-scoped API token to attempt a POST request to these endpoints and observe if the operation succeeds.

• Example curl command to test POST /api/v1/projects with a read token: curl -X POST https://your-coolify-instance/api/v1/projects -H "Authorization: Bearer <read-scoped-token>" -d '{"name":"test-project"}' -H "Content-Type: application/json"
• Example curl command to test POST /api/v1/cloud-tokens/{uuid}/validate: curl -X POST https://your-coolify-instance/api/v1/cloud-tokens/<uuid>/validate -H "Authorization: Bearer <read-scoped-token>"

Successful mutation or validation with a read token indicates the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers or users with read-scoped API tokens to perform unauthorized state-changing actions. This can lead to unauthorized validation of cloud tokens and servers, potentially compromising the integrity of your server and application management processes.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows read-scoped API tokens to perform state-changing operations, violating the intended permission model and potentially enabling unauthorized resource creation and operational changes.

Such unauthorized access and modification capabilities could lead to data integrity and security issues, which may impact compliance with standards and regulations like GDPR and HIPAA that require strict access controls and protection of sensitive data.

However, the provided information does not explicitly discuss the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coolify to version 4.0.0-beta.466 or later, where the issue has been fixed.

Useful 0 Not Useful 0