Critical · published January 24, 2025
🚨 A missing authorization flaw in Coolify lets any authenticated user snag private keys and take control of your server! 🔥 Think of it like a restaurant where anyone with a reservation can access the kitchen and use any chef's recipes without permission. It’s a recipe for chaos! This vulnerability is absolutely devastating: an attacker could execute arbitrary commands on the victim's server, potentially leading to data breaches, service interruptions, or even total server takeover. Imagine someone flipping the switch on your entire operation without you knowing!
Think of it like a restaurant where anyone with a reservation can access the kitchen and use any chef's recipes without permission. It’s a recipe for chaos! Prior to version 4.0.0-beta.361, Coolify failed to enforce authorization checks, allowing any authenticated user to attach existing private keys to their server if the configuration matched. This oversight enables remote command execution through the Terminal feature.
This vulnerability is absolutely devastating: an attacker could execute arbitrary commands on the victim's server, potentially leading to data breaches, service interruptions, or even total server takeover. Imagine someone flipping the switch on your entire operation without you knowing! Upgrade Coolify immediately to version 4.0.0-beta.361 or later to patch this critical vulnerability. Review your server configurations to ensure they are secure, and consider implementing stricter access controls for authenticated users. You've got this! Follow the steps above, and you'll have those servers secured in no time! 🛡️