CVE-2025-22611

Executive Summary

CVE-2025-22611 is a critical missing authorization vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. This flaw allows any authenticated user to escalate their own or any other team member's privileges to any role, including the owner role. The attacker can also remove other members from the team, including admins and owners. This effectively grants the attacker full control over the Coolify instance, enabling access to the Terminal feature and the ability to execute arbitrary remote commands on managed servers. The vulnerability has a CVSS score of 10.0 (Critical) and affects all versions prior to 4.0.0-beta.361.

Supply Chain & Package Security

Coolify is a self-hosted application, not a package distributed via NPM, PyPI, Go, or Ruby registries. Therefore, supply chain security concerns are limited to the integrity of the source code and Docker images used for deployment. Users should verify the authenticity of the Coolify source code and Docker images from the official GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - The attacker only needs a valid user account with any role.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the Coolify application.
• Confidentiality (C): High (H) - Full access to all data managed by Coolify.
• Integrity (I): High (H) - Full control over configurations and managed servers.
• Availability (A): High (H) - Ability to disrupt services and remove team members.

Threat Level: Critical. The vulnerability is trivial to exploit and grants complete control over the Coolify instance and its managed infrastructure.

Deep Dive & Mechanics

The vulnerability stems from a missing authorization check in the team management functionality of Coolify. The application fails to verify that a user has the necessary permissions to perform privilege escalation or team member removal actions. This allows any authenticated user to send crafted API requests to modify team roles or remove members without proper authorization.

Attack Flow:

1. An attacker authenticates to the Coolify panel with any valid user account.
2. The attacker identifies the API endpoints responsible for team management (e.g., updating user roles, removing team members).
3. The attacker sends a crafted HTTP request to escalate their own role to "owner" or to remove other team members.
4. Once the attacker has the owner role, they can access the Terminal feature, which allows execution of arbitrary commands on any server managed by Coolify.
5. The attacker can then execute commands to exfiltrate data, deploy malware, or pivot to other systems.

Vulnerable vs. Patched Code

The vulnerability is in the backend API logic that handles team member role updates and removals. The vulnerable code does not check if the requesting user has the required permissions (e.g., admin or owner role) to perform these actions.

Vulnerable Code (Conceptual):

@app.route('/api/teams/<team_id>/members/<member_id>/role', methods=['PUT'])
def update_member_role(team_id, member_id):
    # Missing authorization check
    new_role = request.json.get('role')
    update_user_role(member_id, new_role)
    return jsonify(success=True)

Patched Code (Conceptual):

@app.route('/api/teams/<team_id>/members/<member_id>/role', methods=['PUT'])
def update_member_role(team_id, member_id):
    current_user = get_current_user()
    if not current_user.is_admin() and not current_user.is_owner():
        return jsonify(error="Unauthorized"), 403
    new_role = request.json.get('role')
    update_user_role(member_id, new_role)
    return jsonify(success=True)

The patched version adds a check to ensure the requesting user has admin or owner privileges before allowing role changes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Coolify instance (version < 4.0.0-beta.361).
• Valid credentials for any user account.

Exploitation Steps:

1. Log in to the Coolify panel.
2. Open the browser's developer tools (F12) and navigate to the Network tab.
3. Perform a legitimate action, such as viewing team members, to capture the API request format.
4. Identify the API endpoint for updating user roles (e.g., /api/teams/{team_id}/members/{member_id}/role).
5. Send a PUT request to this endpoint with the following payload:

   {
     "role": "owner"
   }
   

6. The response should indicate success, and the attacker's role will be escalated to owner.
7. Access the Terminal feature and execute arbitrary commands on managed servers.

Example cURL Command:

curl -X PUT 'https://coolify.example.com/api/teams/1/members/2/role' \
  -H 'Authorization: Bearer <attacker_token>' \
  -H 'Content-Type: application/json' \
  -d '{"role": "owner"}'

Blue Team

Detection:

• Monitor API logs for unauthorized role change requests.
• Look for PUT requests to /api/teams/*/members/*/role with unusual role values (e.g., "owner").
• Alert on any role escalation events, especially from non-admin users.

Hunting:

• Search for logs where a user with a low-privilege role (e.g., "viewer") successfully changes their role to "admin" or "owner".
• Correlate these events with subsequent access to the Terminal feature.

Prevention:

• Immediately upgrade to Coolify version 4.0.0-beta.361 or later.
• Implement network segmentation to limit access to the Coolify panel.
• Use a Web Application Firewall (WAF) to block suspicious API requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • PUT requests to /api/teams/*/members/*/role with role values other than the user's current role.
  • Unusual access to the Terminal feature from non-admin users.
• System IOCs:
  • New user accounts with elevated privileges (owner role).
  • Removal of legitimate team members without authorization.
  • Execution of unexpected commands on managed servers via the Terminal feature.
• Log IOCs:
  • API logs showing successful role changes without proper authorization checks.
  • Audit logs indicating privilege escalation events.

Detection Engineering

YARA Rule

rule CVE_2025_22611_Coolify_PrivEsc {
    meta:
        description = "Detects Coolify privilege escalation attempts via missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22611"
    strings:
        $api_endpoint = "/api/teams/"
        $role_change = "role"
        $owner_role = "owner"
    condition:
        all of them
}

Sigma Rule

title: Coolify Privilege Escalation via Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to escalate privileges in Coolify by exploiting CVE-2025-22611
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: coolify
detection:
    selection:
        http.method: 'PUT'
        http.url|contains: '/api/teams/'
        http.url|contains: '/members/'
        http.url|contains: '/role'
        http.body|contains: 'owner'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22611 Coolify Privilege Escalation Attempt"; flow:to_server; http.method; content:"PUT"; http.uri; content:"/api/teams/"; distance:0; content:"/members/"; distance:0; content:"/role"; distance:0; http.request_body; content:"owner"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coolify: Update to version 4.0.0-beta.361 or later immediately.
2. Review User Roles: Audit all user accounts and team memberships. Remove any unauthorized accounts or role changes.
3. Rotate Credentials: Change all API tokens and passwords for the Coolify instance.
4. Check for Compromise: Review server logs for any signs of unauthorized access or command execution.

Long-Term Mitigations:

• Implement the principle of least privilege for all user accounts.
• Enable multi-factor authentication (MFA) for all Coolify users.
• Regularly audit API logs for suspicious activity.
• Deploy a Web Application Firewall (WAF) to block unauthorized API requests.
• Keep Coolify and all dependencies up to date.

Valters IT