Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in Dokploy, a self-hostable Platform as a Service. An unauthenticated attacker could potentially forge verification tokens to gain administrative access and execute commands on the host system, posing a significant risk to systems running affected versions.
- Unauthenticated access and host command execution possible.
- Significant risk to systems running affected versions.
- Confirm relevance and review exposure of Dokploy instances.
Attack Path
How an attacker could exploit the issue
An attacker can exploit Dokploy by sending a specially crafted request to forge an administrative JSON Web Token (JWT). This allows them to bypass authentication and gain unauthorized access to the system, potentially leading to the execution of commands on the host machine through the SSH terminal.
- Unauthenticated network access required.
- Forging JWTs bypasses authentication.
- Command execution on the host.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an unauthenticated attacker could forge JWTs and trigger auto-sign-in as an administrator, potentially leading to command execution on the host system through the SSH terminal.
- Host system access.
- Forge JWTs to gain admin access.
- Execute commands on the host.
Operational Fix
Recommended remediation, mitigation, and detection steps
The self-hosted nature of Dokploy as a Platform as a Service (PaaS) indicates that teams responsible for managing internal platforms, applications, or infrastructure are likely accountable. The initial practical step is to determine the scope of deployment, confirm reachability and criticality, identify the specific asset owners, and then prioritize remediation based on risk.
- Platform or application owners should take ownership.
- Verify Dokploy's reachability and criticality.
- Plan remediation based on verified exposure.
