Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a command injection vulnerability in Coolify, a server and application management tool. The flaw, present in versions prior to 4.0.0-beta.451, allows authenticated users with management permissions to execute arbitrary commands on managed servers as root by exploiting improper sanitization of a file storage parameter.
- Authenticated users can run any command on servers.
- This impacts systems managing applications, servers, and databases.
- Confirm relevance and exposure of this management tool.
Attack Path
How an attacker could exploit the issue
An attacker with application management permissions could exploit this vulnerability by manipulating the File Storage Directory Mount Path functionality. This involves sending specially crafted input to the `file_storage_directory_source` parameter, which is then used in shell commands without proper validation. Successful exploitation allows an attacker to execute arbitrary commands as the root user on the managed server, potentially leading to full compromise of the host system.
- Authenticated user with management permissions.
- Unsanitized input in file storage parameter.
- Arbitrary command execution as root.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an authenticated user with service management permissions to execute arbitrary commands as the root user on servers managed by Coolify. This could occur when the "File Storage Directory Mount Path" functionality is used, as the `file_storage_directory_source` parameter is not properly sanitized before being passed to shell commands.
- Managed server root access.
- Unsanitized input passed to shell.
- Full system compromise possible.
Operational Fix
Recommended remediation, mitigation, and detection steps
The owners of Coolify, typically application or infrastructure teams, must first determine the scope of affected instances and their criticality. Coordinating with the vendor for timely updates or implementing temporary mitigations will be necessary steps to manage the risk posed by this vulnerability.
- Application owners should manage the issue.
- Verify instance reachability and criticality first.
- Plan for coordinated updates or vendor engagement.
