Lesson Plan: Red74-Coolio-CVE-2025-64424
Disclaimer: This repository contains a deliberately vulnerable version of Coolify and is intended for educational purposes, CTF environments, and cybersecurity training. Do not deploy this in a production environment or expose it to the public internet.
This lab provides a local, containerized environment to safely learn about and exploit the Command Injection / Remote Code Execution (RCE) vulnerability (CVE-2025-64424 / GHSA-qx24-jhwj-8w6x) found in the Git repository source fields of Coolify versions prior to 4.0.0-beta.420.7.
This lab is a multi-container application that relies on backend services like PostgreSQL, Redis, and a custom host agent to function correctly. It must be deployed using Docker Compose.
Clone this exact repository to your local machine (or the server hosting the CTF lab):
git clone https://github.com/joshbeck2024/ctf-coolify-cve-2025-64424-rce.git
cd ctf-coolify-cve-2025-64424-rce
Navigate to the lab directory and build/start the multi-container stack in detached mode:
cd lab
docker compose up --build -d
Once the containers are successfully running, the vulnerable Coolify web interface will be accessible at:
👉 http://localhost:10005
To safely stop the lab environment without destroying your deployment configurations or database state, run:
cd lab
docker compose down
If you make a mistake, or simply want to completely wipe the lab back to a pristine, clean state (removing all volumes, SSH keys, and database data), run the following:
cd lab
docker compose down -v
docker compose up --build -d
Detailed explanations of the vulnerability, the technical breakdown of the source code flaw, and step-by-step solutions for exploiting the RCE to retrieve the secret flag (/flag/flag.txt) can be found in the Walkthrough/ directory.