Coolify MongoDB Collection Name Injection Leads to RCE (CVE-2025-66209)

Vulnerability Overview CVE-2025-66209: Command Injection via Unsanitized MongoDB Collection Names in Database Backups Vulnerability Description: In Coolify v4.0.0-beta.451, database names in the field are validated and escaped via . However, MongoDB collection names (formatted as ) in are never validated or escaped. An authenticated user with database backup privileges can inject shell commands, leading to Remote Code Execution (RCE). Affected Versions: >= 4.0.0-beta.451, <= 4.0.0-beta.470 Fixed Version: 4.0.0-beta.471 Impact Scope CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Unchanged - Availability: None Impact: 1. Full Server Compromise: Commands are executed with root privileges on the host, with access to the Docker socket. 2. Credential Theft: Access to SSH keys, environment variables, and secrets for all instances. 3. Lateral Movement: Propagation to all managed servers using stolen SSH keys. 4. Persistence: Malicious payloads are re-executed on every scheduled backup run. 5. Container Escape: Direct access to the Docker socket allows escaping container isolation. Remediation Fixed Version: 4.0.0-beta.471 Fix Details: Validation and escaping of MongoDB collection names to prevent command injection. POC Code Complete Attack Chain 1. An authenticated user creates/updates a MongoDB database backup via the API using . 2. The backup job runs immediately (if or within schedule). 3. validator: (passed validation). (not validated). 4. Shell command: 5. Passed to , which wraps and executes bash on the remote SSH server. 6. Command substitution executes with root privileges on the managed server. Code Diff Vulnerable Code (permalink) Comparison with Secure Code (Database Name) in the Same Function Collection names should receive the same treatment, but they do not. API Input Validation Is Also Insufficient The and API endpoints in only validate the database name as (lines 696, 911)—with no shell safety validation. The Livewire component ( ) uses for validation, but this only applies to PostgreSQL/MySQL formats, not MongoDB formats. Therefore, collection names are not separately validated even via the Web UI. Impact An authenticated user with database management privileges (any team member by default) can execute arbitrary commands as root on any managed server. This allows: 1. Full Server Compromise: Commands are executed with root privileges on the host, with access to the Docker socket. 2. Credential Theft: Access to SSH keys, environment variables, and secrets for all instances. 3. Lateral Movement: Propagation to all managed servers using stolen SSH keys. 4. Persistence: Malicious payloads are re-executed on every scheduled backup run. 5. Container Escape: Direct access to the Docker socket allows escaping container isolation. This is an exploit of CVE-2025-66209 affecting the "fixed" version v4.0.0-beta.451.

Goal Reached Thanks to every supporter — we hit 100%!

Coolify MongoDB Collection Name Injection Leads to RCE (CVE-2025-66209)

More from this source