Command Injection in Dokploy Self-Hosted PaaS

Executive Summary

Dokploy before version 0.29.13 has a flaw in the createCommand() function where it builds shell commands by inserting compose service names and settings directly into bash command strings. If a compose file has a specially crafted name or service definition, the shell interprets special characters as command separators, letting attackers run arbitrary commands on the Docker host.

Useful 0 Not Useful 0

Detection Guidance

Check Dokploy version with 'dokploy version'. If it is below 0.29.13, the system is vulnerable. Inspect compose service names and configurations for shell metacharacters or unusual patterns that could indicate malicious input.

Useful 0 Not Useful 0

Impact Analysis

An attacker could take control of the Docker host where Dokploy is running, install malware, steal data, or disrupt services. Any user with permission to deploy compose files could exploit this to run commands as the host system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations and penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Review and sanitize all compose service names and configurations to remove any shell metacharacters or suspicious inputs before deployment.

Useful 0 Not Useful 0