Horizon Alert
Summary of the vulnerability and why it matters
A command injection vulnerability exists in Coolify, a tool for managing servers and applications. This flaw allows authenticated users with management permissions to execute arbitrary commands as the root user on affected servers by manipulating proxy configuration filenames.
- Unauthenticated users can execute commands as root.
- It impacts server and application management.
- Confirm relevance and exposure for management tools.
Attack Path
How an attacker could exploit the issue
An attacker with permission to manage applications or services can exploit this vulnerability by manipulating proxy configuration filenames. These filenames are processed without proper security checks, allowing them to be used in shell commands, leading to arbitrary command execution with root privileges on the server.
- Authenticated user with management permissions.
- Unsanitized proxy configuration filename input.
- Arbitrary command execution as root.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an authenticated user with application or service management permissions could execute arbitrary commands as root on managed servers. This is possible because proxy configuration filenames are not properly escaped when passed to shell commands, potentially allowing for full remote code execution.
- System commands could be executed.
- Unsanitized filenames could trigger execution.
- Compromise of managed servers.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Coolify application owner, or the team managing the infrastructure where Coolify is deployed, is responsible for addressing this vulnerability. The first step is to identify all instances of Coolify, confirm their accessibility and business criticality, and then establish the responsible parties for remediation.
- Application and infrastructure teams own this.
- Verify Coolify instances and their exposure.
- Plan and execute upgrades or mitigations.
