CVE-2025-22607

Executive Summary

CVE-2025-22607 is a missing authorization vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, any authenticated user can fetch the details page for any GitHub or GitLab configuration on a Coolify instance by only knowing the UUID of the model. This exposes sensitive OAuth credentials, including the "client id", "client secret", and "webhook secret". The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as HIGH severity due to the exposure of secrets that could lead to account takeover, supply chain compromise, or lateral movement. The patch is available in version 4.0.0-beta.361.

Supply Chain & Package Security

This vulnerability is not directly in a package manager (NPM, PyPI, Go, Ruby) but affects the Coolify application itself. However, the exposed GitHub/GitLab OAuth credentials could be used to compromise the software supply chain if the victim's repositories contain CI/CD pipelines or package publishing tokens.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs only a valid user account on the Coolify instance.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - OAuth secrets are fully exposed.
• Integrity (I): None (N) - The vulnerability does not allow modification of data.
• Availability (A): None (N) - The vulnerability does not affect availability.

Threat Level: HIGH (7.5) - The exposure of OAuth secrets can lead to severe downstream impacts.

Deep Dive & Mechanics

The vulnerability resides in the API endpoint that serves the details of a GitHub or GitLab configuration. The endpoint is likely of the form /api/v1/integrations/github/{uuid} or similar. The application fails to verify that the authenticated user is authorized to view the specific configuration. Instead, it only checks that the user is authenticated and that the UUID exists in the database.

The UUID is a predictable or enumerable identifier (e.g., a version 4 UUID). An attacker can enumerate UUIDs by:

1. Observing UUIDs in other API responses (e.g., when listing integrations).
2. Brute-forcing UUIDs if the application does not rate-limit.
3. Using leaked UUIDs from other sources.

Once the attacker has a valid UUID, they can send a GET request to the endpoint and receive the full configuration object, including client_id, client_secret, and webhook_secret.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.0.0-beta.361):

// Vulnerable: No authorization check
public function show($uuid)
{
    $config = GitHubConfig::where('uuid', $uuid)->firstOrFail();
    return response()->json($config);
}

Patched Code (4.0.0-beta.361):

// Patched: Authorization check added
public function show($uuid)
{
    $config = GitHubConfig::where('uuid', $uuid)->firstOrFail();
    // Ensure the authenticated user owns this configuration
    if ($config->user_id !== auth()->id()) {
        abort(403, 'Unauthorized');
    }
    return response()->json($config);
}

The patch adds a check to ensure the authenticated user is the owner of the configuration. This prevents any authenticated user from accessing configurations they do not own.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on a vulnerable Coolify instance (version < 4.0.0-beta.361).
• Knowledge of at least one UUID of a GitHub/GitLab configuration.

Exploitation Steps:

1. Authenticate: Obtain a session cookie or API token by logging in.
2. Enumerate UUIDs: If the application exposes a list of integrations (e.g., /api/v1/integrations), parse the UUIDs from the response. Otherwise, attempt to brute-force UUIDs using a tool like uuidgen or a known pattern.
3. Fetch Configuration: Send a GET request to the endpoint:

   curl -X GET https://coolify.example.com/api/v1/integrations/github/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
     -H "Authorization: Bearer <token>"
   

4. Extract Secrets: Parse the JSON response to obtain client_id, client_secret, and webhook_secret.

Lab Setup:

• Deploy a vulnerable Coolify instance using Docker:

  docker run -d -p 8080:80 coolify/coolify:4.0.0-beta.360
  

• Create two user accounts: one with a GitHub integration, one without.
• As the attacker (user without integration), attempt to access the other user's integration UUID.

Blue Team

Detection:

• Monitor API logs for requests to /api/v1/integrations/github/* or /api/v1/integrations/gitlab/* from users who do not own the corresponding configuration.
• Alert on multiple failed UUID enumeration attempts (e.g., 404 errors on non-existent UUIDs).
• Monitor for unusual access to the client_secret or webhook_secret fields in logs.

Hunting:

• Search for logs where a user accesses an integration UUID that is not associated with their user ID.
• Correlate with authentication logs to identify the attacker's session.

Indicators of Compromise (IOCs)

• Network:
  • GET requests to /api/v1/integrations/github/{uuid} or /api/v1/integrations/gitlab/{uuid} from unexpected users.
  • High volume of 404 errors on integration endpoints (UUID enumeration).
• Application:
  • Unauthorized access to client_secret or webhook_secret fields in application logs.
  • New OAuth tokens generated from the compromised client credentials.
• External:
  • Unusual activity on the victim's GitHub/GitLab account (e.g., new SSH keys, new webhooks, new OAuth apps).

Detection Engineering

YARA Rule

rule Detect_Coolify_OAuth_Exposure {
    meta:
        description = "Detects attempts to exploit CVE-2025-22607 by accessing GitHub/GitLab config endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22607"
    strings:
        $endpoint_github = "/api/v1/integrations/github/"
        $endpoint_gitlab = "/api/v1/integrations/gitlab/"
        $client_secret = "client_secret"
        $webhook_secret = "webhook_secret"
    condition:
        any of ($endpoint_*) and any of ($client_secret, $webhook_secret)
}

Sigma Rule

title: Coolify OAuth Secret Exposure via Missing Authorization
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized access to GitHub/GitLab configuration endpoints in Coolify
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith:
            - '/api/v1/integrations/github/'
            - '/api/v1/integrations/gitlab/'
    condition: selection
falsepositives:
    - Legitimate access by the configuration owner
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22607 - Coolify OAuth Secret Exposure"; flow:to_server,established; content:"GET"; http_method; content:"/api/v1/integrations/github/"; http_uri; content:"/api/v1/integrations/gitlab/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Coolify to version 4.0.0-beta.361 or later.
2. Rotate all exposed client_secret and webhook_secret values in GitHub/GitLab.
3. Revoke any OAuth tokens that may have been generated using the compromised secrets.

Long-term:

1. Implement proper authorization checks on all API endpoints that expose sensitive data.
2. Use UUIDs that are not predictable (e.g., version 4 UUIDs) and implement rate-limiting on enumeration attempts.
3. Audit all existing integrations for signs of compromise.
4. Monitor GitHub/GitLab audit logs for unauthorized access.

Workaround (if patching is not immediately possible):

• Restrict network access to the Coolify API to trusted IPs only.
• Disable the integration endpoints temporarily by modifying the web server configuration to return 403 for /api/v1/integrations/*.

Valters IT
DevSecOps & Cyber Threat Intelligence