CVE-2025-22609

Executive Summary

CVE-2025-22609 is a critical missing authorization vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. This flaw allows any authenticated user to attach any existing private key on a Coolify instance to their own server. If the server configuration (IP/domain, port, and user) matches the victim's server, the attacker can use the Terminal feature to execute arbitrary commands on the victim's server. The vulnerability has a CVSS score of 10.0, indicating maximum severity. The patch is available in version 4.0.0-beta.361.

Supply Chain & Package Security

Coolify is distributed as a Docker image and via GitHub releases. Users should verify the integrity of their Coolify installation and ensure they are running a patched version. The vulnerability does not directly affect the software supply chain but can be exploited by authenticated users to compromise other servers managed by the same Coolify instance.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authenticated user)
• User Interaction: None
• Scope: Changed (Attacker can compromise other servers)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Deep Dive & Mechanics

The vulnerability resides in the authorization logic for attaching private keys to servers. In Coolify, users can manage SSH keys for server access. The missing authorization check allows any authenticated user to attach any existing private key (belonging to other users or the system) to their own server. Once attached, if the server's IP/domain, port (typically 22), and user (e.g., root) match the victim's server, the attacker can use the Terminal feature to execute arbitrary commands on the victim's server.

The root cause is the lack of proper access control when associating a private key with a server. The application does not verify that the authenticated user owns or has permission to use the specified private key.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.0.0-beta.361): The vulnerable code likely does not check if the authenticated user is the owner of the private key being attached. For example, in a controller or service method:

// Vulnerable: No ownership check
public function attachKeyToServer(Request $request, $serverId) {
    $key = PrivateKey::find($request->input('key_id'));
    $server = Server::find($serverId);
    $server->private_key_id = $key->id;
    $server->save();
    // ...
}

Patched Code (4.0.0-beta.361): The patched version adds an authorization check to ensure the user owns the key:

// Patched: Ownership check added
public function attachKeyToServer(Request $request, $serverId) {
    $key = PrivateKey::where('id', $request->input('key_id'))
                     ->where('user_id', auth()->id())
                     ->firstOrFail();
    $server = Server::findOrFail($serverId);
    $server->private_key_id = $key->id;
    $server->save();
    // ...
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Authenticated access to a Coolify instance (any user account).
• Knowledge of a victim's server IP/domain, SSH port (default 22), and username (e.g., root).
• A private key stored in the Coolify instance that can access the victim's server.

Exploitation Steps:

1. Log in to Coolify as an authenticated user.
2. Navigate to the server management section.
3. Create a new server entry with the victim's IP/domain, port, and username.
4. When prompted to select an SSH key, choose any existing private key from the list (even if not owned by you).
5. Save the server configuration.
6. Use the Terminal feature to execute arbitrary commands on the victim's server.

Example Command Execution:

# After attaching the key, use the terminal to run commands
whoami
id
cat /etc/shadow

Blue Team (Defender)

Detection:

• Monitor Coolify logs for unusual server creation or key attachment events.
• Look for multiple failed SSH authentication attempts from the Coolify server to other hosts.
• Check for unauthorized SSH key usage in audit logs.

Hunting Queries:

• Search for server creation events where the user is not the owner of the attached key.
• Monitor for terminal sessions initiated from Coolify to unexpected IP addresses.

Indicators of Compromise (IOCs)

• Network: SSH connections from the Coolify server to unexpected IP addresses on port 22.
• Logs: Coolify audit logs showing key attachment events where user_id does not match the key's user_id.
• Files: Unauthorized SSH keys in the Coolify database attached to servers not owned by the key owner.
• Behavior: Multiple server creation events in a short period from a single user.

Detection Engineering

YARA Rule

rule CVE_2025_22609_Coolify_Missing_Auth {
    meta:
        description = "Detects Coolify source code with missing authorization for private key attachment"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22609"
        severity = "critical"
    strings:
        $s1 = "private_key_id" nocase
        $s2 = "attachKeyToServer" nocase
        $s3 = "PrivateKey::find" nocase
        $s4 = "->save()" nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: Coolify Missing Authorization for Private Key Attachment
id: cve-2025-22609
status: experimental
description: Detects attempts to attach a private key to a server without proper authorization in Coolify
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22609
logsource:
    product: coolify
    service: audit
detection:
    selection:
        event: "key_attached_to_server"
        user_id|not_equals: key_owner_id
    condition: selection
falsepositives:
    - Legitimate admin actions (if admin has override permissions)
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2025-22609 Coolify Unauthorized SSH Key Usage"; flow:to_server,established; content:"SSH"; depth:4; content:"|00 00 00 00|"; within:4; reference:cve,2025-22609; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coolify to version 4.0.0-beta.361 or later.
2. If upgrade is not possible, restrict user permissions to prevent key attachment.
3. Review all existing server configurations and private key associations for unauthorized attachments.

Long-term Mitigations:

• Implement strict access controls for SSH key management.
• Enable audit logging and monitor for suspicious activities.
• Use network segmentation to limit the impact of compromised Coolify instances.
• Regularly rotate SSH keys and review key ownership.

Workarounds:

• Disable the Terminal feature for non-admin users.
• Implement a custom middleware to enforce key ownership checks.

Valters IT