CyberRota Analysis
AI-GeneratedThe vulnerability affects Coolify versions prior to 4.0.0-beta.471, where the GitHubApp api_url field is improperly utilized for server-side HTTP requests without adequate allowlisting or blocking of private IPs. This flaw allows authenticated users to manipulate the configuration of a GitHub App, potentially leading to unauthorized access to internal services or cloud metadata endpoints. Organizations using Coolify should prioritize upgrading to the fixed version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp api_url field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a GitHub App source that causes Coolify to request internal services or cloud metadata endpoints. This issue is reported as fixed in version 4.0.0-beta.471.