Horizon Alert
Summary of the vulnerability and why it matters
This advisory highlights a critical vulnerability in Dokploy, a self-hosted platform for managing cloud services. The issue involves improper authorization checks in how the service handles interactive commands, potentially allowing unauthorized users to gain full control of the host system. This could lead to a significant compromise of all deployed services and data managed by Dokploy.
- Unauthorized access can control the entire system.
- It impacts how services are managed and secured.
- Confirm relevance and exposure to Dokploy usage.
Attack Path
How an attacker could exploit the issue
An attacker with authenticated access to Dokploy can exploit a flaw in its WebSocket handlers. These handlers authenticate users but fail to authorize their actions, allowing any authenticated member to gain an interactive shell within any container on the host. By targeting the Dokploy container that mounts the Docker socket, an attacker can escalate privileges to root on the host, potentially compromising the entire system and all tenant data.
- Authenticated access required.
- Uncontrolled WebSocket commands trigger vulnerability.
- Host compromise and data breach.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, authenticated members could potentially gain unauthorized access to interactive shells within containers. This access could allow them to escape the application's boundaries and potentially achieve root-level control over the host system, crossing tenant isolation.
- Host system compromise.
- Unauthorized container access.
- Full host control.
Operational Fix
Recommended remediation, mitigation, and detection steps
In a self-hosted PaaS deployment like Dokploy, the platform team or infrastructure team is likely responsible for managing the service, while application owners would be accountable for the applications deployed *on* Dokploy. The initial practical step involves identifying all Dokploy instances, confirming their reachability and business criticality, and then locating the specific team or individual accountable for each instance to plan a coordinated remediation.
- Platform or Infrastructure teams own resolution.
- Verify Dokploy instance reachability and criticality.
- Plan remediation and coordinate vendor updates.
