Arbitrary File Read in Dockhand Before 1.0.55

Executive Summary

Dockhand before version 1.0.55 has an arbitrary file read vulnerability. Authenticated users with stacks:create permission can read sensitive files by providing a malicious composePath during stack adoption. This allows access to files like encryption keys, SQLite databases, or /proc/self/environ via the compose endpoint, potentially exposing all stored credentials.

Useful 0 Not Useful 0

Detection Guidance

Check Dockhand version with `dockhand version` or inspect installed packages. Monitor API logs for unusual `composePath` parameters or file read requests to sensitive paths like /proc/self/environ or encryption key locations. Use `curl` to test if the compose endpoint returns file contents when given arbitrary paths.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials and specific permissions could read sensitive system files, including credentials, encryption keys, or configuration data. This could lead to unauthorized access, data breaches, or further exploitation of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Dockhand to version 1.0.55 or later immediately. Revoke `stacks:create` and `stacks:edit` permissions for non-admin users until patched. Audit recent API activity for unauthorized file reads. Restrict Docker container access to sensitive host directories.

Useful 0 Not Useful 0