Command Injection in Coolify Database Backup

Executive Summary

This vulnerability exists in Coolify versions from 4.0.0-beta.451 through 4.0.0-beta.470. It involves the handling of database backups for MongoDB collection names, where the software did not fully validate shell metacharacters. This flaw allows a highly privileged attacker, who has the ability to configure backup inputs, to inject arbitrary commands via these unvalidated shell metacharacters.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves command injection via MongoDB collection names in backup inputs of Coolify versions 4.0.0-beta.451 through 4.0.0-beta.470. Detection involves checking if your Coolify instance is running a vulnerable version and if the backup configuration inputs allow injection of shell metacharacters.

To detect exploitation attempts or presence of malicious inputs, you can audit the backup configurations for suspicious characters such as $(), backticks, semicolons, or other shell metacharacters in the `databases_to_backup` field, especially in MongoDB collection name specifications (e.g., strings like `mydb:$(touch /tmp/pwned)`).

Suggested commands to detect suspicious backup configurations or evidence of exploitation include:

• Check backup configuration files or API backup inputs for suspicious patterns using grep:
• grep -rE '\$\(|`|;|>|\|\|' /path/to/coolify/configs
• Search for suspicious files or artifacts created by command injection, e.g.:
• ls -l /tmp/pwned
• Monitor running backup jobs or logs for unexpected shell command executions or errors related to malformed database backup inputs.

Additionally, verify the Coolify version to ensure it is at least 4.0.0-beta.471 or later, where this vulnerability is fixed.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a highly privileged attacker to execute arbitrary commands on the system by injecting shell commands through the backup configuration inputs. This could lead to unauthorized actions affecting the integrity and confidentiality of the database backups, potentially compromising the system or data managed by Coolify.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a highly privileged attacker to execute arbitrary shell commands on the managed server with root privileges by injecting commands through MongoDB collection names in backup inputs.

This can lead to full server compromise, credential theft, lateral movement, persistence, and container escape, which could result in unauthorized access to sensitive data.

Such unauthorized access and potential data breaches could violate compliance requirements under standards like GDPR and HIPAA, which mandate protection of personal and sensitive data against unauthorized access and ensure system integrity.

Therefore, the vulnerability poses a risk to compliance by potentially enabling data breaches and loss of control over protected data environments.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coolify to version 4.0.0-beta.471 or later, where the issue with database backup handling for MongoDB collection names has been fixed.

Useful 0 Not Useful 0