CyberRota Analysis
AI-GeneratedThe TrustProxies middleware in Coolify prior to version 4.0.0-beta.471 is vulnerable due to its configuration that trusts all proxies, allowing unauthenticated attackers to exploit the X-Forwarded-Host header. Additionally, a flaw in the TrustHosts middleware creates a circular caching issue that prevents proper validation of host headers, enabling attackers to generate password reset links pointing to malicious domains. Organizations using affected versions should prioritize upgrading to the fixed version to mitigate the risk of token theft and account takeover.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxies = '*'), accepting X-Forwarded-Host from any source. The TrustHosts middleware, intended to prevent host header attacks, has a circular caching dependency that prevents it from ever validating hosts. When a password reset is requested, the ResetPassword notification generates the reset URL using url(route(..., false)), which derives the host from the (spoofable) request. An unauthenticated attacker can trigger a password reset email containing a link pointing to an attacker-controlled domain, enabling token theft and account takeover. This issue is fixed in version 4.0.0-beta.471.