Coolify vulnerabilities

In Coolify prior to 4.0.0-beta.474, the HMAC key for GitHub webhooks can be null, causing an empty string to be used as the key. An attacker can compute a valid signature and trigger unauthorized deployments.

In Coolify prior to 4.0.0-beta.470, a critical authenticated remote code execution (RCE) vulnerability was found. The flaw is in the handling of the install_command parameter, which is directly concatenated into a shell command during Nixpacks build, allowing arbitrary command execution on the host.

In Coolify prior to version 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with network management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without sanitization, enabling full remote code execution.

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim and modify the Host header to a malicious value. The victim receives a password reset email with a link to the malicious host, and if clicked, the reset token is sent to the attacker's server, allowing account takeover.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available.

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, a low-privileged user (member) can view and use invitation links sent to an administrator. If they use the link before the legitimate recipient, they can log in as an administrator, resulting in privilege escalation.

Coolify (starting with version 4.0.0-beta.434) has a vulnerability that allows bypassing the rate limit on the /login endpoint by rotating the X-Forwarded-For header. This enables unlimited credential stuffing and brute-force attempts against user and admin accounts.

Coolify up to version v4.0.0-beta.434 contains a vulnerability that allows a low-privileged user (member) to invite a high-privileged user (administrator). Although the first invitation attempt fails with an error, clicking the invite button a second time succeeds. This enables an attacker to invite themselves as an administrator, then reset the password and log in with admin privileges.

Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints. An authenticated team member can read a highly sensitive `email_change_code` belonging to other users on the same team. This code is intended for single-use email change verification and should remain secret.

Coolify versions up to and including v4.0.0-beta.420.6 are vulnerable to a stored XSS attack in the project creation workflow. An authenticated low-privileged user can create a project with a malicious name containing JavaScript, which executes in the admin's browser when the project or resource is deleted. Version 4.0.0-beta.420.7 contains a patch.

Coolify before version 4.0.0-beta.420.7 contains a Remote Code Execution (RCE) vulnerability in the application deployment workflow. A low-privileged member can inject arbitrary Docker Compose directives during project creation or updates, allowing to mount the host filesystem and execute commands with root privileges, bypassing container isolation.

A remote code execution vulnerability in Coolify versions prior to v4.0.0-beta.420.7 allows authenticated users with low-level privileges to inject arbitrary shell commands via the Git Repository field during project creation, leading to full server compromise.

A remote code execution vulnerability in Coolify prior to v4.0.0-beta.420.6 allows authenticated low-privilege users to inject malicious Docker Compose directives during project creation, mounting the host filesystem and gaining full root access.