Command Injection in Coolify Prior to 4.0.0-beta.474

Executive Summary

This vulnerability exists in Coolify, an open-source tool for managing servers, applications, and databases. Before version 4.0.0-beta.474, the buildHelperImage method in the file app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without properly escaping shell commands. This means that an attacker who can set the helper version and trigger the helper image build in a development environment can execute arbitrary commands on the server.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with the ability to set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This could lead to unauthorized actions such as modifying files, stealing data, or disrupting services on the affected server.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Coolify to version 4.0.0-beta.474 or later, where the issue has been fixed.

Avoid allowing untrusted users to set the dev_helper_version field or trigger the helper image build in development environments.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated attacker to execute arbitrary commands on the server, potentially leading to data exfiltration or lateral movement within the network.

Such unauthorized access and potential data breaches could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized access.

However, the vulnerability is rated as low severity (CVSS 3.8) due to the need for authenticated access and complexity of exploitation, and it is limited to development environments.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves command injection through the dev_helper_version field used in Docker build commands within Coolify versions prior to 4.0.0-beta.474. Detection involves identifying if an affected version of Coolify is running and if the dev_helper_version field can be manipulated.

To detect potential exploitation or presence of the vulnerability on your system, you can:

• Check the Coolify version to confirm if it is older than 4.0.0-beta.474.
• Audit logs or command histories for suspicious Docker build commands that include unusual or unexpected shell characters or commands injected via the dev_helper_version field.
• Monitor for unexpected processes or reverse shell connections that could indicate exploitation.

Suggested commands to assist detection:

• Check Coolify version (adjust path as needed): `coolify --version` or check the application version in the UI or deployment manifests.
• Search for suspicious Docker build commands in logs: `grep -r "docker build" /var/log/`
• Look for suspicious shell characters or command injection patterns in dev_helper_version settings stored in configuration files or databases.
• Monitor running processes for unexpected shells: `ps aux | grep sh` or `netstat -tulnp` to detect unusual network connections.

Useful 0 Not Useful 0