Coollify Account Takeover via CSRF-able Password Reset (CVE-like advisory and patch)

Vulnerability Overview Vulnerability Name: Account takeover via CSRF-vulnerable GET endpoint that resets password to an attacker-known value Vulnerability Description: This vulnerability exists in the project, specifically within the endpoint. When the query parameter is present, the endpoint performs a state-changing action, resetting the user's password to a value known to the attacker (i.e., the UUID from the invitation link). Since GET requests are not protected by CSRF tokens, any team administrator can craft an invitation link containing , tricking the victim into clicking it and logging in, thereby achieving account takeover. Impact Scope Affected Versions: Fixed Version: CVSS Score: 8.0 / 10 (High) Attack Vector: Network Attack Complexity: High Required Privileges: None User Interaction: Required Scope: Changed Confidentiality Impact: High Integrity Impact: High Availability Impact: None Remediation Recommended Remediation 1. Remove the parameter entirely (Recommended) - In the file, remove the logic handling the parameter. - The modified code is as follows: 2. Convert to a POST request and add CSRF protection - If password reset functionality during invitation acceptance is strictly required, change the method to POST and enforce CSRF protection. - The modified code is as follows: Proof of Concept (PoC) Additional Information CWE: - CWE-352: Cross-Site Request Forgery (CSRF) — state-changing action via GET request without anti-CSRF protection - CWE-640: Weak Password Recovery Mechanism for Forgotten Password — password set to a value known to the inviter Attack Chain: 1. The attacker (a team administrator) navigates to Team -> Members -> Invitations. 2. Create Invitation: The attacker enters the victim's email address and clicks "Invite via Link." The server generates a UUID and creates the invitation. 3. Copy Link: The invitation link is displayed. The attacker copies this link. 4. Craft Malicious URL: The attacker appends to the link. 5. Social Engineering: The attacker sends the link to the victim,诱骗ing them to click it. 6. Victim clicks the link (while logged into Coollify): The GET request triggers . 7. Password Reset: Since is true, is executed. 8. Team Addition: The victim is added to Team A, and the invitation is deleted. 9. Attacker Login: The attacker logs in using and the UUID as the password. 10. Password Change: The attacker completes the forced password reset flow and sets a new password. 11. Account Takeover Completed: The attacker gains full access, locking out the victim. Impact: - Account Takeover: The attacker gains full access to the victim's Coollify account, including all teams, servers, applications, and secrets. - Silent Compromise: The victim performs normal invitation acceptance behavior with no signs of password changes. - Infrastructure Access: Using the victim's account, the attacker can manage all servers, deploy applications, read environment variables, and secrets. - Privilege Escalation: If the victim is a root administrator ( ), the attacker gains management control over the entire Coollify instance. - Lateral Movement: The attacker can use the victim's SSH keys and server access for further attacks. Additional Hardening: - Never set passwords to values derived from IDs, URLs, or other data. - If password reset during invitation is required, generate a separate random password and send it to the user via a secure channel (do not derive it from the invitation UUID). - Audit all GET endpoints that perform state-changing operations — GET requests should always be safe and idempotent, in accordance with HTTP standards. Credit: - This vulnerability was discovered and reported by bugbunny.ai.

Goal Reached Thanks to every supporter — we hit 100%!

Coollify Account Takeover via CSRF-able Password Reset (CVE-like advisory and patch)

More from this source