Coollify Vulnerability Advisory: Multiple Input Validation Flaws

Vulnerability Overview A security issue was identified in the Coollabs/coollify project. The specific manifestations are: Model Mass Assignment Protection: Explicit attributes are missing in all models. Docker Network Name Validation: Lack of validation and escaping for Docker network names. Notification Webhook Field Validation: Lack of URL validation for notification Webhook fields. Password Reset URL Generation: Lack of server-side configuration for generating password reset URLs. Install/Build/Start Command Field Validation: Lack of input validation for install/build/start command fields. Resource Limit Field Validation: Lack of input validation for resource limit fields. Custom DNS Server Input Validation: Lack of validation for custom DNS server inputs. Proxy Redirect URL Validation: Lack of validation for proxy redirect URLs. Server Advanced Settings Page Validation: Lack of input validation for the server advanced settings page. Sentinel Configuration Validation: Lack of input validation for Sentinel configuration. Database Backup Timeout Validation: Lack of input validation for database backup timeout. Email Configuration Validation: Lack of input validation for email configuration. Database Public Port and Proxy Port Validation: Lack of input validation for database public ports and proxy ports. Blocking Unverified URLs: Failure to block unverified URLs. Email Change Verification Code: Insufficient randomness in the email change verification code. Impact Scope These vulnerabilities may impact the following areas: Data Integrity: Lack of input validation may lead to malicious tampering with data. Security: Missing explicit attributes and insufficient randomness in verification codes may lead to data leakage or unauthorized access. System Stability: Lack of validation for Docker network names and notification Webhook fields may lead to incorrect system configurations, affecting system stability. Remediation 1. Model Mass Assignment Protection: - Add explicit attributes to all models. 2. Docker Network Name Validation: - Add validation and escaping for Docker network names. 3. Notification Webhook Field Validation: - Add URL validation for notification Webhook fields. 4. Password Reset URL Generation: - Add server-side configuration for generating password reset URLs. 5. Install/Build/Start Command Field Validation: - Add input validation for install/build/start command fields. 6. Resource Limit Field Validation: - Add input validation for resource limit fields. 7. Custom DNS Server Input Validation: - Add validation for custom DNS server inputs. 8. Proxy Redirect URL Validation: - Add validation for proxy redirect URLs. 9. Server Advanced Settings Page Validation: - Add input validation for the server advanced settings page. 10. Sentinel Configuration Validation: - Add input validation for Sentinel configuration. 11. Database Backup Timeout Validation: - Add input validation for database backup timeout. 12. Email Configuration Validation: - Add input validation for email configuration. 13. Database Public Port and Proxy Port Validation: - Add input validation for database public ports and proxy ports. 14. Blocking Unverified URLs: - Block unverified URLs. 15. Email Change Verification Code: - Use random number generation for the email change verification code. POC Code or Exploit Code No specific POC code or exploit code is provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Coollify Vulnerability Advisory: Multiple Input Validation Flaws

More from this source