PostgreSQL Command Injection in Coolify

Executive Summary

This vulnerability exists in Coolify, an open-source tool for managing servers, applications, and databases. Before version 4.0.0-beta.474, the PostgreSQL healthcheck command generation used database settings (postgres_user and postgres_db) that could be controlled by an authenticated user. These settings were incorporated into shell-form commands, which allowed the attacker to inject arbitrary commands that would be executed inside the database container.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves command injection through PostgreSQL healthcheck commands in Coolify versions prior to 4.0.0-beta.474. Detection involves checking if your system is running a vulnerable version of Coolify and if the PostgreSQL healthcheck commands are constructed using user-controlled inputs without proper escaping.

To detect exploitation attempts or presence of this vulnerability, you can look for suspicious or malformed PostgreSQL user or database names that include shell metacharacters such as ;, |, $(), or backticks, which could indicate command injection attempts.

Since the vulnerability allows execution of arbitrary commands inside the PostgreSQL container, you can check for unexpected files or outputs created by injected commands. For example, the proof-of-concept creates a file /tmp/hc_rce.txt inside the container.

Suggested commands to detect signs of exploitation or vulnerability include:

• Inspect running Coolify version: Check if the version is earlier than 4.0.0-beta.474.
• Examine PostgreSQL user and database names for suspicious characters: Use SQL queries like `SELECT usename FROM pg_user;` or `SELECT datname FROM pg_database;` inside the PostgreSQL container.
• Check for unexpected files created by injected commands inside the PostgreSQL container, e.g., `docker exec -it <postgres_container> ls /tmp` to look for files like hc_rce.txt.
• Review Docker healthcheck commands in the container configuration to see if they use shell-form commands that interpolate user inputs.

Useful 0 Not Useful 0

Impact Analysis

An attacker who is authenticated can exploit this vulnerability to execute arbitrary commands within the database container. This can lead to a full compromise of the database environment, including unauthorized access, data manipulation, or destruction. The CVSS score of 8.8 indicates a high severity with impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user to inject commands executed in the database container, potentially leading to unauthorized access or modification of sensitive data.

Such unauthorized access or data manipulation could result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

Therefore, if exploited, this vulnerability could compromise compliance with these common standards by exposing sensitive information or disrupting system integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Coolify to version 4.0.0-beta.474 or later, where the issue has been fixed.

Useful 0 Not Useful 0