Coolify SSRF in GitHub App API URL via Livewire UI (GHSA-3gfr-cxv5-3c7h)

Vulnerability Overview Vulnerability Name: Server-Side Request Forgery via Attacker-Controlled GitHub App API URL Vulnerability ID: GHSA-3gfr-cxv5-3c7h Severity: Medium (CVSS 3.1: 5.0) Description: Attack Vector: Network - Exploitable via Livewire UI or API (POST , PATCH ) Attack Complexity: Low - Set to an internal address and trigger the fetch operation Required Privileges: Low - Any authenticated user can create/edit GitHub App sources ( returns for all checks) User Interaction: None Scope: Changed - The vulnerability is within Coolify's GitHub integration, but it affects resources beyond Coolify's authorization boundary, reaching internal network services Confidentiality Impact: Low - HTTP requests use a fixed path suffix ( ), limiting the attacker's control over the request; response data is partially returned (error message fields, timing differences) rather than the full response Integrity Impact: None - Read-only SSRF; POST requests target fixed paths with empty/irrelevant bodies Availability Impact: None Affected Components Affected Components: - — (lines 37-45) — Stores with only validation - — (lines 294-298) — HTTP GET to - — (line 17) — HTTP GET to (lines 48-51) — HTTP POST to - — (lines 89-94) — Uses macro for all GitHub API calls - — (lines 68-80) — Passes directly without filtering CWE: CWE-918: Server-Side Request Forgery (SSRF) Execution Chain: 1. Input: Attacker authenticates and navigates to Sources → Add GitHub App (or edits an existing one) 2. Malicious URL Setup: Attacker sets to (cloud metadata), (Redis), or any internal address 3. Storage: The URL is stored in its raw form in the table. No model-layer validation or sanitization is applied 4. Trigger: Attacker clicks "Update GitHub App Name" on the GitHub App configuration page, invoking 5. SSRF Execution: Laravel's HTTP client (Guzzle) makes a GET request from the Coolify server to (or any specified internal address) 6. Response Leakage: Error handling returns the response's JSON field to the attacker. Timing differences also reveal whether the target service is reachable Remediation Option 1: Add URL Validation and Private IP Blocking (Recommended) Create a custom validation rule or use a URL validation helper to block requests to private/internal addresses: Apply to all entry points: Option 2: Allow Known GitHub API Hosts If only supporting GitHub.com and GitHub Enterprise: This is stricter but simpler. GitHub Enterprise users need to allow their GHE domain. Additional Hardening Add validation to the field, which is used to build installation and permissions URLs Re-enable the authorization check (currently all methods return , with real checks commented out) Consider adding DNS rebinding protection by resolving the URL at validation time and checking the resolved IP again during the actual HTTP request Add the validation rule to Livewire components (currently only used in API controllers) Proof of Concept (POC) UI POC (Based on Timing/Errors) 1. Log in as an authenticated user 2. Navigate to Sources → Add new GitHub Source 3. Set "API URL" to (or for cloud metadata) 4. Set "HTML URL" to (any value) 5. Save the GitHub Source 6. On the configuration page, set a dummy App ID and Private Key 7. Click "Update GitHub App Name" to trigger 8. Observe the error response timing — connection refused errors occur quickly, while timeouts indicate the port is open. A successful connection with an error message confirms internal service accessibility and may leak response data via the "message" field API POC Impact Internal Service Scanning: Attackers can probe the internal network using timing differences to identify reachable services (open ports are more distinct than closed ports after filtering) Cloud Metadata Access: On cloud deployments (AWS, GCP, Azure), attackers can reach instance metadata endpoints; although fixed path suffixes limit data extraction, reachability confirmation exacerbates other attacks Partial Response Data Leakage: Error messages from include the target service's JSON field, enabling the extraction of error details from internal APIs Internal Service Interaction: POST requests to can trigger state changes in internal services that accept POST requests Credits This vulnerability was discovered and reported by bugbunny.ai.

Goal Reached Thanks to every supporter — we hit 100%!

Coolify SSRF in GitHub App API URL via Livewire UI (GHSA-3gfr-cxv5-3c7h)

More from this source