Authentication Bypass in Dockhand via Static-Asset Path

Executive Summary

Dockhand before version 1.0.45 has an authentication bypass flaw. The global auth hook incorrectly allows unauthenticated access to paths ending in static-asset extensions like .js, including /api/* routes. Additionally, user-mutation handlers fail to enforce authentication, allowing unauthenticated attackers to send PUT requests to /api/users/<id>.js to reset passwords and take over accounts.

Useful 0 Not Useful 0

Detection Guidance

Check if your Dockhand instance is running a version before 1.0.45. Test for the vulnerability by sending a PUT request to /api/users/<id>.js and verifying if authentication is bypassed. Example: curl -X PUT http://<target>/api/users/1.js -H 'Content-Type: application/json' -d '{"password":"newpass"}'

Inspect server logs for suspicious PUT requests targeting .js paths under /api/users/. Look for repeated attempts to modify user accounts without proper authentication.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated remote attackers can exploit this to reset passwords for any user, including administrators, and gain full control over accounts. This could lead to unauthorized data access, modification, or deletion, and potential compromise of the entire system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's integrity and confidentiality principles or HIPAA's access controls. Unauthorized account takeover could result in data breaches, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dockhand to version 1.0.45 or later immediately to patch the authentication bypass. If upgrading is not possible, restrict access to /api/users/* paths and block PUT requests with .js extensions at the firewall or web server level.

Temporarily disable the global auth hook if it is not required for static assets. Rotate all admin and user passwords as a precaution, especially if unauthorized access was suspected.

Useful 0 Not Useful 0