Jeongbeannnn

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.474 **Description** Database credential fields are validated only as strings at the API layer without shell-safety checks. These values are interpolated directly into Docker Compose YAML commands without escaping, which can lead to command injection. The affected variables include `redis password`, `keydb password`, `dragonfly password`, `clickhouse admin user`, `clickhouse admin password`, `postgres user`, and `mysql user`. **Recommendations** Update to version 4.0.0-beta.474.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.474 **Description** An issue exists where the `manual webhook secret github` field, used by webhook endpoints to validate incoming requests, is nullable and lacks a default value. For newly created applications, this secret remains null. Because the `hash hmac()` function in PHP coerces a null key into an empty string, the server generates a deterministic hash that can be independently calculated. An unauthenticated attacker can exploit this by providing a forged signature in the `X-Hub-Signature-256` header to trigger unauthorized deployments. **Recommendations** Update to version 4.0.0-beta.474.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.35.10 **Description** The Plugin URL upload endpoint "POST /api/plugin" contains a flaw in how it validates submitted URLs. It uses a simple substring check to verify if the `url` variable contains ".tar.gz", which can be bypassed by placing that string anywhere in the path, query string, or fragment. This allows the URL to proceed to the `fetchWithBlacklist()` function without proper validation of the host, scheme, or path, leading to Server-Side Request Forgery (SSRF). SSRF is a vulnerability where an attacker can force the server to make requests to an unintended location, such as internal services. This issue can be exploited in two primary scenarios: when the `BLACKLIST IPS` configuration is empty, bypassing the default SSRF blacklist, or when the plugin server follows HTTP redirects from an external URL to an internal target due to the default behavior of `node-fetch` with `redirect: 'follow'`. This could allow access to internal network services, such as AWS/GCP/Azure IMDS for credential theft, CouchDB, or Redis. **Recommendations** Update to version 3.35.10. As a temporary workaround, restrict access to the "POST /api/plugin" endpoint to only trusted users with the Global Builder role.