Critical · published January 24, 2025
🚨 Prior to version 4.0.0-beta.374, Coolify had a gaping security hole that allowed any authenticated user to snag private keys in plain text! Think of it like a restaurant where the kitchen staff can snoop through the vault for customer credit cards just because they have access to the dining room. They didn’t need a secret pass; they just walked right in! An attacker with access could potentially execute arbitrary commands on any matching server, leading to a nightmare of data breaches, system compromise, and complete control over the server’s operations. This could be absolutely devastating for businesses relying on Coolify for server management!
Think of it like a restaurant where the kitchen staff can snoop through the vault for customer credit cards just because they have access to the dining room. They didn’t need a secret pass; they just walked right in! The vulnerability arises from a missing authorization check, allowing authenticated users to access sensitive information, specifically private keys, without proper restrictions. If the attacker’s server configuration aligns with the victim’s, they can execute arbitrary commands remotely.
An attacker with access could potentially execute arbitrary commands on any matching server, leading to a nightmare of data breaches, system compromise, and complete control over the server’s operations. This could be absolutely devastating for businesses relying on Coolify for server management! Immediately upgrade Coolify to version 4.0.0-beta.374 or later to patch this vulnerability. Additionally, review user roles and permissions to ensure no unnecessary access is granted to authenticated users. Regularly monitor server configurations to avoid alignment with potential attackers. You've got this! By taking swift action, you can secure your Coolify instance and keep your data safe! 🛡️