CVE-2025-22612

Executive Summary

CVE-2025-22612 is a critical vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The flaw resides in a missing authorization check, allowing any authenticated user to retrieve existing private keys stored on a Coolify instance in plain text. If the attacker's server configuration (IP/domain, port, user) matches a victim's server, the attacker can leverage the stolen private key to execute arbitrary commands on the remote server. This vulnerability has a CVSS score of 10.0, indicating maximum severity. The issue is patched in version 4.0.0-beta.374.

Supply Chain & Package Security

Coolify is a self-hosted application, not a package distributed via NPM, PyPI, Go, or Ruby. However, the vulnerability impacts the supply chain of any organization using Coolify to manage servers, as the exposure of private keys can lead to full compromise of managed infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authenticated user)
• User Interaction: None
• Scope: Changed (Impact on managed servers)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows an authenticated attacker to exfiltrate private keys and potentially gain full control over remote servers managed by Coolify.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). Coolify stores SSH private keys used to connect to managed servers. An API endpoint or internal function responsible for retrieving these keys does not properly verify that the requesting user has the necessary permissions. As a result, any authenticated user (even with low privileges) can request and receive the private keys in plain text.

Attack Flow:

1. An attacker authenticates to the Coolify instance (e.g., via a compromised account or self-registration if enabled).
2. The attacker sends a request to the vulnerable endpoint (e.g., /api/keys or similar) to retrieve all stored private keys.
3. The server returns the private keys in plain text without authorization checks.
4. The attacker scans for servers matching the IP/domain, port (typically 22), and user (root) associated with the stolen key.
5. Using the private key, the attacker establishes an SSH connection and executes arbitrary commands on the victim server.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.0.0-beta.374):

// No authorization check
public function getKeys() {
    return Key::all(); // Returns all keys to any authenticated user
}

Patched Code (4.0.0-beta.374):

// Authorization check added
public function getKeys() {
    $this->authorize('viewAny', Key::class); // Ensures user has permission
    return Key::all();
}

The patch introduces a proper authorization gate, ensuring only users with the correct role (e.g., admin) can view private keys.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Coolify instance (authenticated user).
• The vulnerable endpoint is accessible.

Exploitation Steps:

1. Authenticate to Coolify and obtain a session token.
2. Send a GET request to the vulnerable endpoint:

   curl -X GET https://coolify-instance/api/keys \
     -H "Authorization: Bearer <token>"
   

3. Parse the response to extract private keys (PEM format).
4. For each key, attempt SSH connection to the associated server:

   ssh -i extracted_key root@target-server
   

5. If successful, execute arbitrary commands.

Note: No public exploit code is available at this time.

Blue Team (Defense & Detection)

Immediate Actions:

1. Upgrade Coolify to version 4.0.0-beta.374 or later.
2. Rotate all SSH keys that were stored in Coolify.
3. Review access logs for unauthorized key retrieval attempts.
4. Implement network segmentation to limit Coolify's exposure.

Detection:

• Monitor for unusual API calls to /api/keys or similar endpoints.
• Alert on multiple failed SSH authentication attempts using keys associated with Coolify.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual outbound SSH connections from the Coolify server to unknown IPs.
  • API requests to /api/keys from unexpected user accounts.
• File IOCs:
  • Presence of private key files in unexpected locations (e.g., /tmp/).
• Log IOCs:
  • Coolify audit logs showing key retrieval by unauthorized users.
  • SSH authentication logs showing successful logins using keys not associated with known users.

Detection Engineering

YARA Rule

rule CVE_2025_22612_Coolify_Key_Exfil {
    meta:
        description = "Detects attempts to exfiltrate Coolify private keys via API"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22612"
    strings:
        $key_pattern = "-----BEGIN OPENSSH PRIVATE KEY-----"
        $api_endpoint = "/api/keys"
    condition:
        $api_endpoint and $key_pattern
}

Sigma Rule

title: Coolify Private Key Exfiltration Attempt
id: cve-2025-22612
status: experimental
description: Detects unauthorized access to Coolify private key API endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/keys'
    condition: selection
falsepositives:
    - Legitimate admin key management
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22612 Coolify Private Key Exfiltration"; flow:to_server; content:"GET"; http_method; content:"/api/keys"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Coolify to version 4.0.0-beta.374 or later.
2. Rotate all SSH keys that were stored in the vulnerable instance.
3. Review user accounts and remove any unauthorized users.

Long-term:

• Implement strict access controls (RBAC) for all API endpoints.
• Encrypt sensitive data at rest (e.g., private keys should be encrypted with a master key).
• Enable audit logging and monitor for suspicious activity.
• Regularly update Coolify to the latest version.

Workaround (if patching is not possible):

• Disable the vulnerable API endpoint via reverse proxy rules.
• Restrict access to Coolify to trusted IPs only.
• Use a separate key management solution (e.g., HashiCorp Vault) for SSH keys.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert