coollabsio/cooliing v4.0.0-beta.474 Security Patch: Shell Injection, SSRF, and Webhook Key Remediation

Vulnerability Overview In the project, multiple security-related issues exist that could potentially lead to data loss, service disruption, or security vulnerabilities. Impact Scope Data Loss: Accidental pruning of persistent containers (databases, applications, services) during service deletion can lead to data loss. Service Disruption: The S3 storage backup endpoint returning a 500 error in the API context may cause service disruptions. Security Vulnerabilities: - Manually configured webhook keys are not encrypted, and HMAC signature verification is weak. - The Rocky Linux installer uses an incorrect RHEL Docker repository. - Manual Authentication: Upgrade email verification hashing and fix invitation link login. - Validation and rate limiting for feedback endpoints. - Volume name and path validation with shell parameter escaping. - Backup upload file type and size restrictions. - S3 endpoint URL validation. - Dev assistant version validation and build parameter escaping. - Team-scoped cross-resource creation process. - SSH repository URLs with custom ports are broken. - Health check path validation rejects commas and semicolons. - Database credential validation and shell escaping for Postgres, MySQL, and MariaDB. - Shell command tokenization for install, build, and start commands. - Stable, generic error messages for API 5xx responses. Remediation Data Loss: Prevent persistent containers from being accidentally pruned during service deletion. Service Disruption: Fix the issue where the S3 storage backup endpoint returns a 500 error in the API context. Security Vulnerabilities: - Encrypt manually configured webhook keys and strengthen HMAC signature verification. - Use the correct RHEL Docker repository when installing Rocky Linux. - Upgrade email verification hashing and fix invitation link login. - Implement validation and rate limiting for feedback endpoints. - Implement volume name and path validation with shell parameter escaping. - Enforce backup upload file type and size restrictions. - Validate S3 endpoint URLs. - Validate dev assistant versions and escape build parameters. - Secure the team-scoped cross-resource creation process. - Fix SSH repository URLs with custom ports. - Reject commas and semicolons in health check path validation. - Implement database credential validation and shell escaping for Postgres, MySQL, and MariaDB. - Tokenize shell commands for install, build, and start commands. - Provide stable, generic error messages for API 5xx responses. POC Code or Exploit Code No specific POC code or exploit code is included in the page. Summary This version (v4.0.0-beta.474) primarily addresses multiple security-related issues, including data loss, service disruptions, and security vulnerabilities. The remediation measures cover data protection, service stability, and various security enhancements.

Goal Reached Thanks to every supporter — we hit 100%!

coollabsio/cooliing v4.0.0-beta.474 Security Patch: Shell Injection, SSRF, and Webhook Key Remediation

More from this source