Command Injection in Dokploy Prior to 0.29.8

Executive Summary

Dokploy is a self-hostable Platform as a Service (PaaS). The vulnerability exists in versions prior to 0.29.8 where the getRegistryCommands() function in the server code interpolates registry credentials directly into a shell command without proper escaping. This allows an authenticated user with project access to inject malicious commands via registry settings, leading to arbitrary OS command execution on the Dokploy server.

Useful 0 Not Useful 0

Detection Guidance

Check Dokploy version with 'dokploy --version' or inspect the server's package files for versions below 0.29.8. Review project configurations for suspicious registry credentials or deployment settings that may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with project access could execute arbitrary OS commands on the Dokploy server, potentially reading or modifying host files, accessing other containers through Docker, and gaining control over the host system. This could lead to data breaches, unauthorized access, or complete system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to compromised sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dokploy to version 0.29.8 or later immediately. Revoke access for any untrusted users with project permissions. Audit registry configurations and deployment logs for signs of unauthorized command execution.

Useful 0 Not Useful 0