Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.
Parameters read from the docker-compose.yaml file are not properly sanitized before use in system commands. An attacker prepares a malicious repository containing a crafted docker-compose.yaml file with embedded commands. When a victim (Coolify user) creates an application from this repository using the 'docker compose' build pack, the values controlled by the attacker are sent directly to commands executed on the server. This results in the execution of arbitrary commands in the context of root privileges.
An attacker gains the ability to execute arbitrary commands on the Coolify server with root privileges, leading to complete system takeover — data theft, backdoor installation, and compromise of managed servers, applications, and databases.
Update Coolify to version 4.0.0-beta.445 or newer, which contains a fix for this vulnerability. Additionally, it is recommended to avoid creating applications from untrusted repositories until the patch is deployed.
Coolify (Coollabs) in versions prior to 4.0.0-beta.445
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCoollabs Coolify
APPCoollabs4.0.0< 4.0.0
Related vulnerabilities
Stored XSS w Coolify — atak przez złośliwą nazwę projektu
Coolify: nieuprawniony dostęp do prywatnego klucza SSH użytkownika root
RCE w Coolify — command injection w konfiguracji Docker Compose
Command injection w polu Git Repository w Coolify
Command injection w Coolify — wykonanie poleceń jako root przez użytkownika