Global infos:

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue.

CVE Status: Awaiting Analysis

References:

[email protected]

Metrics:

Attribute	Value
Attack Complexity	LOW
Attack Vector	NETWORK
Availability Impact	HIGH
Base Score	10
Base Severity	CRITICAL
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Privileges Required	NONE
Scope	CHANGED
User Interaction	NONE
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability Score	3.9
Impact Score	6
Source	[email protected]
Type	Secondary

Links:

Exploit-db
Github