Command Injection in Coolify Prior to 4.0.0-beta.471

Compliance Impact

This vulnerability allows authenticated users to execute arbitrary commands as root on managed servers, potentially leading to full server compromise, lateral movement across infrastructure, and exposure of sensitive data such as SSH keys and database credentials.

Such unauthorized access and data exposure can result in violations of common standards and regulations like GDPR and HIPAA, which require strict controls to protect sensitive personal and health information from unauthorized access and breaches.

Therefore, exploitation of this vulnerability could lead to non-compliance with these regulations due to the risk of data breaches and insufficient access controls.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Coolify versions prior to 4.0.0-beta.471 in the database import Livewire component. It allows an authenticated user to inject arbitrary shell commands through the container name used during database import. This happens because the container name property is client-controllable and is directly interpolated into shell commands without proper locking or validation. Attackers can exploit this to execute commands on the server with elevated privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including remote code execution as root on managed servers. An attacker with team membership, even with low privileges, can execute arbitrary commands, potentially leading to full server compromise, lateral movement across infrastructure, and exposure of sensitive data such as SSH keys and database credentials.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for unusual or unauthorized Livewire wire protocol requests that modify the container property in the database import component. Since the vulnerability allows command injection via the container name, inspecting Livewire update requests for suspicious container names containing special characters like $(), `, ;, |, &&, spaces, or newlines can help identify exploitation attempts.

You can also check your Coolify version to see if it is vulnerable (versions prior to 4.0.0-beta.471 are affected).

Suggested commands to detect potential exploitation attempts or vulnerable versions include:

• Check Coolify version: `coolify --version` or inspect the deployed version in your environment.
• Monitor Livewire requests for suspicious container names by capturing and analyzing network traffic or application logs.
• Search application logs for shell commands or docker commands containing suspicious container names or special characters.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation steps are to upgrade Coolify to version 4.0.0-beta.471 or later, where the vulnerability is fixed.

The fix includes adding the #[Locked] attribute to sensitive properties like the container and serverId to prevent client-side modification, validating container names against a strict regex pattern to reject special characters, and scoping server lookups to the current team to prevent unauthorized server targeting.

Until you can upgrade, restrict access to the database import functionality to trusted users only, monitor for suspicious activity, and consider applying network-level controls to limit exposure.

Useful 0 Not Useful 0