Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in Dokploy, a self-hostable Platform as a Service, that could allow an authenticated user to access or manipulate backup data from other organizations. The issue stems from improper verification of organization permissions when accessing backup credentials, potentially leading to unauthorized data exposure or compromise across tenant boundaries.
- Access to other organizations' backup data.
- Enables cross-tenant data access and manipulation.
- Confirm relevance and scope of impact.
Attack Path
How an attacker could exploit the issue
An authenticated attacker with backup privileges can exploit this vulnerability by manipulating backup operations. By providing a crafted destination ID, they can trick the system into accessing backup credentials belonging to a different organization. This allows the attacker to access sensitive backup data from other tenants or even redirect and corrupt backups across organizational boundaries.
- Authenticated user with backup permissions.
- Crafted destination ID in backup operations.
- Unauthorized access to cross-organizational data.
Live Threat
Current exploitation, exposure, and threat context
An authenticated member with backup permissions for a service in one organization could gain access to another organization's S3 credentials, potentially reading sensitive backup data or redirecting backups. This occurs when the system uses a client-controlled destination ID without verifying ownership, allowing for cross-tenant data manipulation.
- Organization S3 credentials.
- Unverified destination ID usage.
- Read or redirect backup data.
Operational Fix
Recommended remediation, mitigation, and detection steps
Platform-as-a-Service (PaaS) solutions like Dokploy, when self-hosted, often fall under the purview of infrastructure or platform teams responsible for their operation and security. Given this vulnerability allows for unauthorized access to sensitive backup credentials and data across organizations, the initial step is to identify all Dokploy instances, confirm their accessibility and business criticality, and then assign ownership for remediation. This ensures that affected systems are prioritized and that the correct teams are engaged to mitigate the risk of data compromise and tenant data poisoning.
- Platform/Infrastructure teams own this issue.
- Verify affected Dokploy instances and reachability.
- Plan remediation based on confirmed exposure.
