Command Injection in Coolify via Docker Compose Commands

Executive Summary

This vulnerability exists in Coolify versions 4.0.0-beta.471 through 4.0.0-beta.473 due to a regression in the SHELL_SAFE_COMMAND_PATTERN. It allows ampersands to be used in custom Docker Compose build, start, and pre/post-deployment command fields.

Because of this, an authenticated team member can inject shell commands that will execute on the host system, potentially leading to unauthorized command execution.

The issue is fixed in version 4.0.0-beta.474.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your Coolify installation is running a vulnerable version between 4.0.0-beta.471 and 4.0.0-beta.473, where the SHELL_SAFE_COMMAND_PATTERN allowed ampersands in certain command fields, enabling command injection.

To detect exploitation attempts or presence of this vulnerability, you can check for suspicious or unexpected commands in the Docker Compose custom build, start, and pre/post-deployment command fields, especially those containing ampersands (&) or other shell command chaining characters.

Suggested commands to help detect potential exploitation or presence of malicious commands include:

• Inspect the Coolify deployment configuration files or database entries for suspicious command strings containing '&' or other shell metacharacters in the docker_compose_custom_build_command or docker_compose_custom_start_command fields.
• Use grep to search for ampersands in configuration or logs, for example: `grep -r '&' /path/to/coolify/config`
• Monitor running containers for unexpected processes or commands that could indicate injected shell commands.
• Check for unusual activity or commands executed by the coolify-helper container, which has access to the host's Docker socket.

Since the vulnerability requires authenticated deployment permissions, auditing user actions and deployment logs for suspicious command injections is also recommended.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact because it allows an authenticated user to execute arbitrary shell commands on the host system.

• Potential unauthorized access or control over the host system.
• Compromise of confidentiality, integrity, and availability of the system and data.
• Possible disruption of services or deployment processes managed by Coolify.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated team member to inject shell commands that execute on the host, potentially leading to unauthorized access or control over the system.

Such unauthorized command execution can compromise the confidentiality, integrity, and availability of data managed by Coolify, which may include personal or sensitive information.

Therefore, this vulnerability could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls to protect sensitive data and prevent unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Coolify to version 4.0.0-beta.474 or later, where the issue has been fixed.

Useful 0 Not Useful 0