Coolify Terminal WebSocket Authorization Bypass Leading to RCE

Vulnerability Overview Title: Missing Authorization on Terminal WebSocket Bootstrap Route, Allowing Low-Privilege Members to Execute Commands on Team Servers Description: The terminal functionality is intended to be restricted to team administrators/owners, but the websocket bootstrap endpoint only checks if the user is logged in. Consequently, an authenticated low-privilege team member can open an admin-only websocket session and execute commands on team servers where the terminal is enabled. Scope of Impact Affected Versions: (Composer) <= 4.0.0-beta.470 Fixed Versions: (Composer) 4.0.0-beta.471 CVSS Score: 9.0 / 10 (Critical) Attack Vector: Network Attack Complexity: Low Required Privileges: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High Remediation Immediate Fix: Enforce the same authorization boundaries on the websocket bootstrap route as are enforced on the terminal UI. Minimal Fix: - Apply to and . - Ensure that low-privilege members receive an authorization failure when accessing these two routes. - Add regression test coverage for: - Unauthenticated users are denied access. - Authenticated non-admin members are denied access. - Authenticated administrators/owners are allowed access. Recommended Hardening: - Stop trusting attacker-controlled SSH command strings as the primary source for target metadata. - Bind terminal websocket requests to server/container identifiers that are authorized by the server side. - Re-validate authorization and only allow terminal command execution during websocket bootstrapping. - Review server and private key visibility rules, as they significantly increase the exploitability and blast radius of this issue. Proof of Concept (PoC) Code Additional Information CVE ID: CVE-2024-34048 Weaknesses: CWE-285, CWE-862 Credit: @mma (Reporter) Attachments --- The above is a summary of key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Coolify Terminal WebSocket Authorization Bypass Leading to RCE

More from this source