Coollify Authenticated RCE in GetLogs Livewire Component (CVE-2024-34599)

Vulnerability Overview Authenticated Remote Code Execution in GetLogs Livewire Component Vulnerability Type: Authenticated Remote Code Execution (Authenticated RCE) Vulnerability Description: An authenticated command injection vulnerability was discovered in the GetLogs Livewire component, allowing users with minimum team privileges (the role) to execute arbitrary commands as on the managed server. The Livewire public property is directly interpolated into shell commands ( , ) without any sanitization. It can be modified by any user accessing via the Livewire protocol because it lacks the attribute. Vulnerable File: Vulnerable Code Locations: - Line 38 (Unlocked public property): - Lines 136, 143, 152, 159, 203, 205, 209, 211 ( is directly interpolated into shell commands without escaping): Vulnerability Root Cause: - The property lacks the attribute, allowing clients to overwrite it via the field in the request. - The injected value is passed to the managed server via SSH using and heredoc, where newlines ( ) in the container name are interpreted as separate command lines. - The method lacks authorization checks and does not call or . Impact Scope Affected Versions: Coollify v4.0-beta.470 and earlier Fixed Version: Coollify 4.0.0-beta.471 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2024-34599 Weakness: CWE-78 Impact: - Remote Code Execution: Arbitrary commands can be executed on the managed server, with output directly returned in the HTTP response. - Root Privileges: All commands are executed as due to Coollify's SSH execution model. - Interactive Webshell: Due to blind injection, command output is returned in the property (line 186 of the Livewire response), allowing attackers to execute full interactive commands via HTTP. - Lack of Authorization: There are no or checks—the component does not verify if the user has permission to access the target server/resource. - Full Server Compromise: Access to SSH private keys, database credentials, application keys, and all data on the managed infrastructure. - Lateral Movement: Coollify stores SSH keys for every connected server, enabling attackers to pivot to all managed hosts. Remediation Add the attribute to prevent client-side modification of the container property: Validate the container name before constructing the shell command, consistent with : Add authorization and server ownership verification: POC Code 1. Log in as a low-privilege team member: - Log in to Coollify using a low-privilege team member account. 2. Switch to a team with database resources (e.g., Root Team): - Navigate to the team possessing database resources. 3. Navigate to the database logs page (e.g., ): - The page renders a Livewire component named , which automatically invokes to fetch container logs via SSH. - The output is displayed in the browser. 4. In Burp HTTP History, locate the request containing and : - The request body contains two components; the second is the component with snapshot data including . - Send this request to Repeater. 5. In Burp Repeater, modify the object in the second component's JSON body to inject the attribute with newline-separated commands, keeping the rest unchanged: - Send the request. The server responds with HTTP 200. The response JSON contains the RCE output directly in the field of the returned Livewire snapshot. 6. Commands executed on the managed server: - Each in the container name becomes a separate command line. 7. Output: - The output is returned directly in the HTTP response, displaying the results of the command execution. Through the steps above, an attacker can exploit this vulnerability to execute arbitrary commands on the managed server, obtain root privileges, and subsequently perform lateral movement.

Goal Reached Thanks to every supporter — we hit 100%!

Coollify Authenticated RCE in GetLogs Livewire Component (CVE-2024-34599)

More from this source