Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in Coolify, an open-source server management tool, that allows authenticated users with specific permissions to execute arbitrary commands on managed servers. This is due to improper handling of PostgreSQL initialization script filenames, which can be exploited to gain root-level access. A fix is available in version 4.0.0-beta.451.
- Allows unauthorized command execution on servers.
- Could lead to compromise of managed systems.
- Confirm relevance and exposure of the tool.
Attack Path
How an attacker could exploit the issue
An attacker with application or service management permissions can exploit this vulnerability by manipulating the filenames of PostgreSQL initialization scripts. These specially crafted filenames are not properly validated and are passed directly to shell commands, allowing the attacker to execute arbitrary commands with root privileges on the managed servers. This can lead to a complete compromise of the affected systems.
- Authenticated access required.
- Unvalidated script filenames trigger command execution.
- Full root code execution on servers.
Live Threat
Current exploitation, exposure, and threat context
An authenticated command injection vulnerability in Coolify, when handling PostgreSQL initialization script filenames, could allow an attacker with application management permissions to execute arbitrary commands as the root user on managed servers. This could occur when the application processes these filenames without proper validation before passing them to shell commands, potentially impacting the integrity and availability of the managed systems.
- Managed servers and their root access.
- Unvalidated script filenames.
- Complete system compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
The application owner and infrastructure teams are likely responsible for addressing this vulnerability in Coolify. The first practical step is to identify all deployed instances of Coolify, confirm their accessibility from the internet or other untrusted networks, and ascertain their business criticality. Once identified and prioritized, a plan for remediation, such as upgrading to a patched version or implementing compensating controls, should be developed in coordination with the relevant teams and potentially the vendor.
- Identify affected Coolify instances.
- Verify exposure and criticality of deployments.
- Plan upgrade or risk reduction actions.
