Coolify Private Key Enumeration Vulnerability Leading to Remote Command Execution

A critical vulnerability in Coolify versions prior to 4.0.0-beta.374 allows authenticated users to access private keys in plain text. If the exposed keys are used in conjunction with matching server configurations—specifically the IP or domain, port (likely 22), and user (root)—an attacker can execute arbitrary commands on the remote server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private keys and, subsequently, remote command execution on the affected server.

Reproduction

The vulnerability can be reproduced by accessing the private key enumeration feature within the Coolify onboarding process. This can be done by calling the 'selectExistingPrivateKey' method, which retrieves private keys without proper authorization.

Remediation

Users should update to Coolify version 4.0.0-beta.374 or later.