Dockhand Path Traversal via Double-Encoding in .env Access

Executive Summary

Dockhand before version 1.0.54 has a path traversal flaw. Authenticated users can manipulate the stack name parameter with double-encoded sequences like %252e%252e to access or modify .env files outside the intended directory. This allows reading secrets, overwriting files, or deleting critical configuration data.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual requests to /api/stacks/[name]/env/raw with double-encoded paths like %252e%252e. Inspect logs for attempts to access .env files outside intended directories. Verify if authenticated users can read, overwrite, or delete unintended files.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access could steal sensitive environment variables, alter deployment settings to inject malicious code, or delete configuration files causing service disruptions. This may lead to data breaches, unauthorized system access, or complete system compromise depending on the exposed secrets.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face fines, legal penalties, and reputational damage due to non-compliance from exposed sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dockhand to version 1.0.54 or later to patch the path traversal flaw. Restrict access to /api/stacks endpoints and validate stack names strictly. Monitor for suspicious activity targeting .env files or directory traversal attempts.

Useful 0 Not Useful 0