Authenticated Command Injection in Coolify via Livewire Component

Executive Summary

This vulnerability exists in Coolify, an open-source tool for managing servers, applications, and databases. Before version 4.0.0-beta.471, there was an authenticated command injection vulnerability in the GetLogs Livewire component. Users with the lowest privilege team member role could exploit this flaw to execute arbitrary commands as root on managed servers.

The issue arises because the $container Livewire public property is directly interpolated into shell commands (such as docker logs and docker service logs) without any sanitization. Since this property can be modified by any client via the Livewire wire protocol and lacks the #[Locked] attribute, it allows attackers to inject malicious commands.

This vulnerability was fixed in version 4.0.0-beta.471.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated command injection in the GetLogs Livewire component of Coolify versions prior to 4.0.0-beta.471. Detection requires verifying if your Coolify instance is running a vulnerable version and if unauthorized command execution attempts are present.

To detect exploitation attempts or presence of this vulnerability on your system, you can:

• Check the Coolify version to confirm if it is 4.0.0-beta.470 or earlier, which are vulnerable.
• Review web server or application logs for suspicious HTTP requests to the GetLogs Livewire component that include unusual container names with newline characters or shell command injection patterns.
• Monitor running processes or docker logs on managed servers for unexpected commands executed as root, especially those triggered by docker logs or docker service logs commands.

Suggested commands to help detect potential exploitation attempts include:

• Check Coolify version: `coolify --version` or review the deployment version information.
• Search web server logs for suspicious requests (example for Linux systems): `grep -i 'GetLogs' /var/log/nginx/access.log | grep -E '\\n|;|&&|\|'`
• Inspect docker container logs for unexpected commands: `docker logs <container_id>` and look for injected commands or anomalies.
• Check for unusual root shell activity or processes spawned by the Coolify service user.

Because exploitation requires authenticated access with team membership, auditing user activity and permissions within Coolify is also recommended.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows users with minimal privileges to execute arbitrary commands as the root user on managed servers.

• Full system compromise due to root-level command execution.
• Potential unauthorized access to sensitive data and system resources.
• Disruption of services or applications running on the affected servers.
• Possibility of installing malware or creating persistent backdoors.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows users with minimal privileges to execute arbitrary commands as root on managed servers, potentially leading to unauthorized access, data breaches, and full system compromise.

Such unauthorized access and potential data exposure can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and access.

Organizations using affected versions of Coolify may face increased risk of non-compliance due to this vulnerability if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coolify to version 4.0.0-beta.471 or later, where the issue is fixed.

This vulnerability allows authenticated users with team membership to execute arbitrary commands as root due to unsanitized input in the GetLogs Livewire component. Upgrading ensures the $container property is properly secured.

Useful 0 Not Useful 0