Activity ID Enumeration Leak in Coolify

Executive Summary

The vulnerability exists in Coolify versions prior to 4.0.0-beta.471 within the ActivityMonitor Livewire component. Specifically, a public property called $activityId is exposed without proper access restrictions (missing the #[Locked] attribute). This property is used to load activity records by their ID without any authorization or team scoping checks.

Because activity IDs are simple auto-incrementing integers, any authenticated user can enumerate these IDs and access activity records belonging to all teams. This allows them to read the full command output from remote SSH processes, which may contain sensitive information such as secrets, configuration files, and infrastructure details.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring and intercepting Livewire POST requests to the endpoint /livewire/update, specifically looking for requests that modify the public $activityId property.

An attacker exploits this by sending crafted POST requests that set arbitrary activityId values to enumerate and access unauthorized activity records.

To detect potential exploitation attempts, you can capture and analyze HTTP POST traffic to /livewire/update and look for unusual or sequential activityId values being set by authenticated users.

• Use a network traffic capture tool like tcpdump or Wireshark to capture HTTP POST requests to /livewire/update.
• Example tcpdump command to capture traffic on port 80 or 443 (adjust interface and port as needed): tcpdump -i eth0 -A 'tcp port 80 or tcp port 443' | grep 'POST /livewire/update'
• Use a web application firewall (WAF) or log analysis to detect POST requests containing the activityId parameter with unexpected or sequential values.
• If you have access to application logs, search for Livewire update requests modifying activityId without proper authorization or from unexpected users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information. An attacker with any authenticated access can enumerate and view activity logs from other teams, potentially exposing secrets, configuration files, and infrastructure details.

Such exposure can compromise the security of your infrastructure, lead to data breaches, and allow attackers to gain further access or cause damage by leveraging the leaked information.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any authenticated user to enumerate activity records across all teams and read sensitive information such as secrets, configuration files, and infrastructure details. This unauthorized access to potentially sensitive data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Since the vulnerability exposes confidential command outputs and configuration details without proper authorization or team scoping, it increases the risk of data breaches and unauthorized disclosure, which are critical compliance concerns under these standards.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Coolify to version 4.0.0-beta.471 or later, where the issue is fixed.

Useful 0 Not Useful 0