An authenticated, low-privileged user without belonging to any organisation can run arbitrary OS commands on the Dokploy host.
Description
Credits
-
DIABL0-SEC Finder
-
bvalmich Finder
-
Siumauricio Remediation developer
DIABL0-SEC
Finder
bvalmich
Finder
Siumauricio
Remediation developer
Impact
An authenticated, low-privileged user without belonging to any organisation can run
arbitrary OS commands on the Dokploy host. The tRPC procedure
docker.getContainersByAppNameMatch interpolates the attacker-supplied appName
value into a Docker CLI call without sanitisation, enabling command injection under the
Dokploy service account.
Patches
v0.23.7