Mike G.A

**Name of the Vulnerable Software and Affected Versions** CasaOS versions up to and including 0.4.15 **Description** CasaOS versions up to and including 0.4.15 have unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The `/v1/users/image` API endpoint can be abused with a user-controlled path parameter to access files under `/var/lib/casaos/1/`, revealing installed applications and configuration details. The `/v1/sys/debug` API endpoint discloses host operating system, kernel, hardware, and storage information. These endpoints also return distinct error messages, enabling file existence enumeration of arbitrary paths on the underlying host filesystem. This information disclosure can be used for reconnaissance and to facilitate targeted follow-up attacks. The `user-controlled path parameter` in the `/v1/users/image` endpoint is a key component of the issue. **Recommendations** CasaOS versions prior to 0.4.15 should be used.

Name of the Vulnerable Software and Affected Versions: Coolify versions prior to v4.0.0-beta.420.6 Description: Coolify is susceptible to a stored cross-site scripting (XSS) attack within the project creation workflow. An authenticated user possessing low privileges can create a project utilizing a maliciously crafted name that incorporates embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload is executed within the administrator’s browser context, potentially leading to a full compromise of the Coolify instance. This compromise may include the theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers. Recommendations: Update to Coolify version 4.0.0-beta.420.6 or later.

Name of the Vulnerable Software and Affected Versions: Coolify versions prior to v4.0.0-beta.420.6 Description: Coolify is susceptible to a remote code execution issue within the application deployment workflow. Authenticated users with low-level member privileges can inject arbitrary Docker Compose directives during project creation. An attacker can achieve full root access to the underlying server by crafting a malicious service definition that mounts the host root filesystem. Recommendations: Update Coolify to version 4.0.0-beta.420.6 or later.

Name of the Vulnerable Software and Affected Versions: Coolify versions prior to v4.0.0-beta.420.7 Description: Coolify is vulnerable to a remote code execution issue in the project deployment workflow. Authenticated users with low-level member privileges can inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, potentially leading to full server compromise. Recommendations: Update Coolify to version 4.0.0-beta.420.7 or later.