Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in Dokploy that allows authenticated users to execute arbitrary shell commands on the host system by manipulating service names during backup operations. This could potentially lead to a full system takeover when scheduled backups are processed.
- Authenticated users can run commands as root.
- This could allow unauthorized host access.
- Confirm relevance and assess exposure.
Attack Path
How an attacker could exploit the issue
An attacker with authenticated access to Dokploy can exploit a vulnerability in the backup procedures by providing specially crafted input for the service name. This input, containing shell metacharacters, is then used in commands executed by the system during scheduled backups. When these backups run, the commands are executed with root privileges, allowing the attacker to potentially compromise the host system by interacting with the mounted Docker socket.
- Authenticated organization member access required.
- Service name parameter in backup procedures.
- Host compromise via root command execution.
Live Threat
Current exploitation, exposure, and threat context
Authenticated organization members could execute arbitrary shell commands on the host system when performing backup operations. This could occur when a user crafts a service name with shell metacharacters, which are then executed as root by scheduled backup jobs.
- Host system command execution
- Via crafted service name in backups
- Complete host takeover
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts the Dokploy platform, likely managed by application owners or infrastructure teams. The initial step is to locate all Dokploy instances, verify their network exposure and business criticality, and identify the accountable system owner. Remediation planning should then be prioritized based on these findings.
- Application owners should address the vulnerability.
- Verify Dokploy instance reachability and criticality.
- Plan remediation based on identified risk.
