Database Backup Command Injection in Coolify

Executive Summary

This vulnerability exists in Coolify versions prior to 4.0.0-beta.471, where the DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names directly into shell commands without proper escaping.

Because of this improper handling, an authenticated user with database management permissions can inject malicious shell commands through specially crafted database credentials or collection names.

This can lead to command injection attacks, allowing execution of arbitrary commands on the managed servers.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an authenticated user with database management permissions to execute arbitrary commands on managed servers, potentially leading to root-level remote code execution (RCE).

This can compromise the confidentiality, integrity, and availability of the affected systems by allowing attackers to run malicious code, access sensitive data, or disrupt services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves command injection through user-controlled database credentials and MongoDB collection names interpolated into backup shell commands without proper escaping.

To detect exploitation attempts or presence of this vulnerability on your system, you can:

• Review backup job configurations and logs for suspicious or malformed database credentials or collection names containing shell metacharacters such as backticks (`), semicolons (;), ampersands (&), or command substitution patterns.
• Check for unexpected shell commands or processes spawned during backup jobs that could indicate command injection.
• Use system auditing tools (e.g., auditd on Linux) to monitor execution of backup commands and detect unusual command arguments.

Specific commands you might run include:

• Inspect running processes related to Coolify backups: `ps aux | grep DatabaseBackupJob`
• Search backup logs for suspicious input patterns: `grep -E '[`;&|$()]' /path/to/backup/logs/*`
• Audit shell command executions during backup jobs: `ausearch -c 'backup_command_name'` (replace with actual command name)

Note that no explicit detection commands are provided in the resources, so these suggestions are based on the nature of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Coolify to version 4.0.0-beta.471 or later, where this vulnerability is fixed.

The fix includes proper escaping of all user-controlled database credentials and MongoDB collection names before they are interpolated into shell commands, preventing command injection.

• Apply the update that uses `escapeshellarg()` for PostgreSQL, MySQL, and MariaDB credentials.
• Apply the update that URL-encodes MongoDB credentials with `rawurlencode()` and escapes the final URI.
• Ensure input validation is in place for MongoDB collection names and database backup inputs to reject or sanitize malicious characters.

If immediate upgrade is not possible, restrict database management permissions to trusted users only, as the vulnerability requires authenticated users with such permissions.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users with database management permissions to execute arbitrary commands on managed servers via command injection in backup jobs. This can lead to unauthorized access, modification, or exposure of sensitive data.

Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls to protect confidentiality, integrity, and availability of personal and sensitive data.

By enabling remote code execution and possible data compromise, this vulnerability increases the risk of non-compliance with these regulations, potentially resulting in legal and financial consequences for affected organizations.

Useful 0 Not Useful 0