Coolify v4 Critical Authenticated RCE Vulnerability in nixpacks Build Command

Vulnerability Overview A critical authenticated host Remote Code Execution (RCE) vulnerability was identified in Coolify v4. The vulnerability exists in the processing of user-defined build parameters, specifically within the of the build pack. Specifically, user-supplied inputs are directly concatenated into a shell command string during the build phase. Attackers can exploit this to escape the build container and execute arbitrary commands, gaining host-level privileges. Impact Scope Affected Versions: = v4.0.0-beta.470 Vulnerable Components: - File: (Line 2335) - Function: - Call Chain: -> Remediation Short-term Mitigation (Escaping) All user-supplied command strings must be properly escaped before being included in shell commands. Use the function to escape each argument. Long-term Prevention 1. Strict Sanitization: Implement a regex whitelist to restrict allowed characters in build step fields. 2. Architectural Isolation: The build process should run in a highly restricted, isolated environment that cannot access sensitive network interfaces or host sockets. POC Code Exploitation Steps 1. Authentication and Access: The attacker logs into the Coolify dashboard using valid credentials. Any user account with the permission to create or manage projects can exploit this vulnerability. 2. Malicious Resource Configuration: The attacker navigates to a project (e.g., "PenProject") and selects "Add New Resource". They select a "Public Repository" and provide a standard Git URL. During the configuration phase, they select Nixpacks as the build pack. 3. Payload Injection ("Why"): To achieve RCE, the attacker targets the install command field. This field is one of the first custom commands executed on the host during the build process (within the builder container). The attacker inputs the following payload: 4. Establish Command and Control: On the attacker's machine (in this scenario, the host), a Netcat listener is initialized to catch the incoming connection: 5. Deployment and Compromise: The attacker saves the configuration and clicks "Deploy". Coolify triggers the deployment job. As soon as the "Generate nixpacks plan" step begins, the injected command is executed by the host's shell. The attacker immediately receives a standard reverse shell, thereby gaining full access to the environment. Technical Vulnerability Analysis Vulnerable Components File: (Line 2335) Function: Call Chain: -> Root Cause Identification The vulnerability stems from an insecure command construction pattern. Within the method, several application configuration parameters, including , are used to construct the command-line string for the binary. The is wrapped in double quotes, but the input undergoes no sanitization or escaping. This constructed string is then passed to , which wraps it in a invocation: Since the original uses double quotes as delimiters for the argument, an attacker can break the quote ( ) and inject arbitrary shell commands (using ). Professional Exploitation Narrative Phase 1: Authentication and Access The attacker logs into the Coolify dashboard using valid credentials. Any user account with the permission to create or manage projects can exploit this vulnerability. Phase 2: Malicious Resource Configuration The attacker navigates to a project (e.g., "PenProject") and selects "Add New Resource". They select a "Public Repository" and provide a standard Git URL. During the configuration phase, they select Nixpacks as the build pack. Phase 3: Payload Injection ("Why") To achieve RCE, the attacker targets the install command field. This field is one of the first custom commands executed on the host during the build process (within the builder container). The attacker inputs the following payload: Payload Analysis 1. : Closes the expected parameter string and terminates the first command. 2. : Initiates an interactive reverse shell to the attacker's listener. 3. : Comments out the remainder of the original command, ensuring no syntax errors interfere with shell execution. Phase 4: Establish Command and Control On the attacker's machine (in this scenario, the host), a Netcat listener is initialized to catch the incoming connection: Phase 5: Deployment and Compromise The attacker saves the configuration and clicks "Deploy". Coolify triggers the deployment job. As soon as the "Generate nixpacks plan" step begins, the injected command is executed by the host's shell. The attacker immediately receives a standard reverse shell, thereby gaining full access to the environment. Remediation and Mitigation Recommendations Short-term Mitigation (Escaping) All user-supplied command strings must be properly escaped before being included in shell commands. Use the function to escape each argument. Long-term Prevention 1. Strict Sanitization: Implement a regex whitelist to restrict allowed characters in build step fields. 2. Architectural Isolation: The build process should run in a highly restricted, isolated environment that cannot acc

Goal Reached Thanks to every supporter — we hit 100%!

Coolify v4 Critical Authenticated RCE Vulnerability in nixpacks Build Command

More from this source