[23:51:26] Using repository: /data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo [23:51:27] Checking out vulnerable release v4.0.0-beta.470 [23:51:27] Vulnerable commit: 575b0766d12bad2a78febff72ab59c017772bcf7 [23:51:27] PHP already available at /tmp/coolify-repro/php (8.5.4) [23:51:27] Composer already available [23:51:27] Composer vendor directory already present [23:51:27] coolify-realtime npm dependencies already present [23:51:27] Applying SQLite-friendly Laravel config patches [23:51:28] ======================================== [23:51:28] VULNERABLE WEBSOCKET COMMAND EXECUTION TEST [23:51:28] ======================================== 2026_02_27_000000_add_public_port_timeout_to_databases ....... 176.82ms DONE 2026_03_11_000000_add_server_metadata_to_servers_table ........ 19.78ms DONE 2026_03_16_000000_add_is_preview_suffix_enabled_to_volume_tables 37.94ms DONE 2026_03_23_101720_add_uuid_to_local_persistent_volumes_table . 150.99ms DONE TOKEN:eyJpdiI6InVUa05rejVlMmx1OXJMQlhBeDR2eWc9PSIsInZhbHVlIjoibmlLelorU29nUllndVp4c0xXdUZhTFBxUEdDVHQrZjJKRm0vUGlQcFZyOGl0dE9TVW1SbEZFRVR4TTdRZUdnYiIsIm1hYyI6IjdmMjJmYjRiYjU2NmMzNzRhY2JjZjI4OWI5NDg0YTcxZTc5YzM2YzI1YzU1YTJkZDAwYWVlNTNmZTIxM2Y5YWMiLCJ0YWciOiIifQ== SUMMARY:member=2;team=3;server=1;server_ip=127.0.0.1;member_role=member [23:51:38] Database prepared (vuln) [23:51:39] Laravel server ready pid=30129 health=200 [23:51:39] Member magic-link login HTTP 302 IPS_STATUS=200 IPS_BODY={"ipAddresses":["127.0.0.1","coolify-testing-host","host.docker.internal","localhost"]} AUTH_STATUS=200 AUTH_BODY={"authenticated":true} [23:51:39] Managed SSH host ready pid=30168 (vuln) [23:51:40] Terminal WebSocket server ready pid=30188 (vuln) [23:51:40] Running WebSocket client (vuln, expected=exec, cookie_names=coolify_session=; XSRF-TOKEN=) [ws-client] CLIENT_WS_OPEN [ws-client] CLIENT_SEND_COMMAND [ws-client] CLIENT_MSG="pty-ready" [ws-client] CLIENT_MSG="REPRO_WS_COMMAND_EXECUTED\r\nvscode\r\n5e94e7f3c337\r\n/tmp\r\n" [ws-client] CLIENT_MSG="pty-exited" [ws-client] CLIENT_ALL=pty-readyREPRO_WS_COMMAND_EXECUTED [ws-client] vscode [ws-client] 5e94e7f3c337 [ws-client] /tmp [ws-client] pty-exited [23:51:40] Vulnerable summary: auth/ips=200 auth=200 websocket_exec=true [23:51:40] ======================================== [23:51:40] FIXED NEGATIVE CONTROL (can.access.terminal middleware) [23:51:40] ======================================== [23:51:41] Fixed route patch applied: 161: Route::post('/terminal/auth', function () { 167: })->name('terminal.auth')->middleware('can.access.terminal'); 169: Route::post('/terminal/auth/ips', function () { 192: })->name('terminal.auth.ips')->middleware('can.access.terminal'); compiled ....................................................... 0.36ms DONE events ......................................................... 0.24ms DONE routes ......................................................... 0.24ms DONE views .......................................................... 0.47ms DONE 2026_02_27_000000_add_public_port_timeout_to_databases ....... 176.89ms DONE 2026_03_11_000000_add_server_metadata_to_servers_table ........ 19.81ms DONE 2026_03_16_000000_add_is_preview_suffix_enabled_to_volume_tables 44.58ms DONE 2026_03_23_101720_add_uuid_to_local_persistent_volumes_table . 155.77ms DONE TOKEN:eyJpdiI6Imk2K2UxYStqYWE1Mjc3UTBjQVUyeUE9PSIsInZhbHVlIjoiL0M3RmszRUt5TVFJdEFOcC90NTkyYk5zSWRLcmR5OTAraDIrTWUwUUFsZVU4UmR6Ly9tdHV6U2lKc0VFNkFFbiIsIm1hYyI6IjI0YWI3YjBiMjA1MmFmZDEzOGM2NDhiYzY2YjQwMmI4ZTEyOGEwODNiMjA0Mjk1NjFkYzc2ODk4NGY3YWM5YWIiLCJ0YWciOiIifQ== SUMMARY:member=2;team=3;server=1;server_ip=127.0.0.1;member_role=member [23:51:51] Database prepared (fixed) [23:51:52] Laravel server ready pid=30280 health=200 [23:51:52] Member magic-link login HTTP 302 IPS_STATUS=403 IPS_BODY={ "message": "Access to terminal functionality is restricted to team administrators", "exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException", "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Application.php", "line": 1440, "trace": [ { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php", "line": 67, "function": "abort", "class": "Illuminate\\Foundation\\Application", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/CanAccessTerminal.php", "line": 24, "function": "abort" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\CanAccessTerminal", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Auth/Middleware/EnsureEmailIsVerified.php", "line": 41, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Auth\\Middleware\\EnsureEmailIsVerified", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/boost/src/Middleware/InjectBoost.php", "line": 22, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Laravel\\Boost\\Middleware\\InjectBoost", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/barryvdh/laravel-debugbar/src/Middleware/InjectDebugbar.php", "line": 66, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Barryvdh\\Debugbar\\Middleware\\InjectDebugbar", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/DecideWhatToDoWithUser.php", "line": 30, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\DecideWhatToDoWithUser", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/CheckForcePasswordReset.php", "line": 36, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\CheckForcePasswordReset", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php", "line": 50, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Routing\\Middleware\\SubstituteBindings", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Auth/Middleware/Authenticate.php", "line": 63, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Auth\\Middleware\\Authenticate", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php", "line": 87, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php", "line": 48, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\View\\Middleware\\ShareErrorsFromSession", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php", "line": 120, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php", "line": 63, "function": "handleStatefulRequest", "class": "Illuminate\\Session\\Middleware\\StartSession", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Session\\Middleware\\StartSession", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php", "line": 36, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php", "line": 74, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Cookie\\Middleware\\EncryptCookies", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 137, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 821, "function": "then", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 800, "function": "runRouteWithinStack", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 764, "function": "runRoute", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 753, "function": "dispatchToRoute", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 200, "function": "dispatch", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "{closure:Illuminate\\Foundation\\Http\\Kernel::dispatchToRouter():197}", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/livewire/livewire/src/Features/SupportDisablingBackButtonCache/DisableBackButtonCacheMiddleware.php", "line": 19, "function": "{closure:Illuminate\\Pipeline\\Pipeline::prepareDestination():178}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Livewire\\Features\\SupportDisablingBackButtonCache\\DisableBackButtonCacheMiddleware", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/barryvdh/laravel-debugbar/src/Middleware/InjectDebugbar.php", "line": 66, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Barryvdh\\Debugbar\\Middleware\\InjectDebugbar", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php", "line": 21, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php", "line": 31, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\ConvertEmptyStringsToNull", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php", "line": 21, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php", "line": 51, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TrimStrings", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Http/Middleware/ValidatePostSize.php", "line": 27, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Http\\Middleware\\ValidatePostSize", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "line": 109, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Http/Middleware/HandleCors.php", "line": 61, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Http\\Middleware\\HandleCors", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/TrustProxies.php", "line": 47, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php", "line": 58, "function": "{closure:App\\Http\\Middleware\\TrustProxies::handle():40}", "class": "App\\Http\\Middleware\\TrustProxies", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/TrustProxies.php", "line": 40, "function": "handle", "class": "Illuminate\\Http\\Middleware\\TrustProxies", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\TrustProxies", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/TrustHosts.php", "line": 30, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\TrustHosts", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 137, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 175, "function": "then", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 144, "function": "sendRequestThroughRouter", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/public/index.php", "line": 51, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/tmp/coolify-repro/laravel_router.php", "line": 5, "function": "require" } ] } AUTH_STATUS=403 AUTH_BODY={ "message": "Access to terminal functionality is restricted to team administrators", "exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException", "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Application.php", "line": 1440, "trace": [ { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php", "line": 67, "function": "abort", "class": "Illuminate\\Foundation\\Application", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/CanAccessTerminal.php", "line": 24, "function": "abort" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\CanAccessTerminal", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Auth/Middleware/EnsureEmailIsVerified.php", "line": 41, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Auth\\Middleware\\EnsureEmailIsVerified", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/boost/src/Middleware/InjectBoost.php", "line": 22, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Laravel\\Boost\\Middleware\\InjectBoost", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/barryvdh/laravel-debugbar/src/Middleware/InjectDebugbar.php", "line": 66, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Barryvdh\\Debugbar\\Middleware\\InjectDebugbar", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/DecideWhatToDoWithUser.php", "line": 30, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\DecideWhatToDoWithUser", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/CheckForcePasswordReset.php", "line": 36, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\CheckForcePasswordReset", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php", "line": 50, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Routing\\Middleware\\SubstituteBindings", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Auth/Middleware/Authenticate.php", "line": 63, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Auth\\Middleware\\Authenticate", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php", "line": 87, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php", "line": 48, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\View\\Middleware\\ShareErrorsFromSession", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php", "line": 120, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php", "line": 63, "function": "handleStatefulRequest", "class": "Illuminate\\Session\\Middleware\\StartSession", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Session\\Middleware\\StartSession", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php", "line": 36, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php", "line": 74, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Cookie\\Middleware\\EncryptCookies", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 137, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 821, "function": "then", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 800, "function": "runRouteWithinStack", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 764, "function": "runRoute", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 753, "function": "dispatchToRoute", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 200, "function": "dispatch", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "{closure:Illuminate\\Foundation\\Http\\Kernel::dispatchToRouter():197}", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/livewire/livewire/src/Features/SupportDisablingBackButtonCache/DisableBackButtonCacheMiddleware.php", "line": 19, "function": "{closure:Illuminate\\Pipeline\\Pipeline::prepareDestination():178}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Livewire\\Features\\SupportDisablingBackButtonCache\\DisableBackButtonCacheMiddleware", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/barryvdh/laravel-debugbar/src/Middleware/InjectDebugbar.php", "line": 66, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Barryvdh\\Debugbar\\Middleware\\InjectDebugbar", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php", "line": 21, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php", "line": 31, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\ConvertEmptyStringsToNull", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php", "line": 21, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php", "line": 51, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TrimStrings", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Http/Middleware/ValidatePostSize.php", "line": 27, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Http\\Middleware\\ValidatePostSize", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "line": 109, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Http/Middleware/HandleCors.php", "line": 61, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "Illuminate\\Http\\Middleware\\HandleCors", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/TrustProxies.php", "line": 47, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php", "line": 58, "function": "{closure:App\\Http\\Middleware\\TrustProxies::handle():40}", "class": "App\\Http\\Middleware\\TrustProxies", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/TrustProxies.php", "line": 40, "function": "handle", "class": "Illuminate\\Http\\Middleware\\TrustProxies", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\TrustProxies", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/app/Http/Middleware/TrustHosts.php", "line": 30, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 219, "function": "handle", "class": "App\\Http\\Middleware\\TrustHosts", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 137, "function": "{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():194}:195}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 175, "function": "then", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 144, "function": "sendRequestThroughRouter", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/data/pruva/project-cache/604602bb-c594-4fc9-8ab9-0e0cf4968a90/repo/public/index.php", "line": 51, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/tmp/coolify-repro/laravel_router.php", "line": 5, "function": "require" } ] } [23:51:52] Managed SSH host ready pid=30319 (fixed) [23:51:53] Terminal WebSocket server ready pid=30339 (fixed) [23:51:53] Running WebSocket client (fixed, expected=blocked, cookie_names=coolify_session=; XSRF-TOKEN=) [ws-client] CLIENT_ERROR=Unexpected server response: 500 [23:51:53] Fixed summary: auth/ips=403 auth=403 blocked=true client_rc=0 [23:51:53] ======================================== [23:51:53] VERIFICATION SUMMARY [23:51:53] ======================================== [23:51:53] Vulnerable: Member endpoints 200/200, WebSocket managed-host command execution=true [23:51:53] Fixed: Member endpoints 403/403, WebSocket blocked=true [23:51:53] SUCCESS: CVE-2026-34047 reproduced with WebSocket command execution and fixed negative control