Coolify: shell metacharacters in env var keys give command execution on managed server hosts

Impact

Coolify builds Docker commands as shell strings and runs them over SSH on each managed server, without escaping environment variable key names. An authenticated user who can set env vars on an application injects metacharacters into a key and executes arbitrary commands on the host itself, outside any container - so this is not a container escape to be argued about, it is direct execution as whatever account Coolify's SSH connection uses, commonly root. Where Coolify manages GPU servers, that is full host compromise of a node running other people's workloads, and the blast radius is every server the Coolify instance holds SSH keys for. Fixed in 4.2.0.

Who can reach it

Any authenticated Coolify user whose role lets them configure an application's environment variables - the vendor scored it PR:L. Reachable wherever the Coolify UI or API is, which for most deployments is an internal or VPN-facing web port rather than the public internet.

What to do

Upgrade Coolify to 4.2.0 and restart the Coolify instance; the fix is in commit b50839d and does not touch the managed hosts, so no drain or reboot of the GPU servers is required. Until you upgrade, tighten which roles can edit application env vars, and treat any Coolify-managed host as compromised if you find unexpected env var keys - the credentials on those hosts, including the SSH keys Coolify uses, should be rotated.

References

Related entries

• runc: Host runc binary overwritten from inside a containerCVE-2019-5736 · runcHigh
• Envoy: ext-authz header handling flaw allows bypassing the external authorization serviceCVE-2021-32777 · EnvoyHigh
• Envoy: URI fragment treated as part of the pathCVE-2021-32779 · EnvoyHigh
• Envoy: Processing continues after a local reply, causing undefined behaviourCVE-2021-32781 · EnvoyHigh
• Envoy: Malicious client constructs permanently valid credentials in the OAuth filterCVE-2023-35941 · EnvoyHigh
• podman build and buildah: race with --jobs during a malicious Containerfile build breaks out to the hostCVE-2024-11218 · podman build / buildah (concurrent --jobs Containerfile build race)High