Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in Dokploy, a self-hostable Platform as a Service, that could allow an authenticated user to write or delete files outside of intended directories. This could potentially impact the integrity and availability of services managed by Dokploy.
- Allows file system compromise by authenticated users.
- Impacts platforms managing application deployments.
- Confirm relevance and exposure of deployed Dokploy instances.
Attack Path
How an attacker could exploit the issue
An attacker with the ability to create or delete certificates can exploit this vulnerability by providing a specially crafted `certificatePath`. This path allows the attacker to write custom certificate content outside the designated directory or to delete files in unrelated directories. The vulnerability lies in how the `certificatePath` input is handled, leading to a bypass of intended directory restrictions.
- Authenticated user required.
- Path traversal with certificate operations.
- Arbitrary file write and deletion.
Live Threat
Current exploitation, exposure, and threat context
An authenticated user with specific permissions in Dokploy could manipulate the `certificatePath` to write arbitrary content to files outside of the intended directory or delete directories. This could affect the integrity and availability of the Dokploy service and potentially the underlying system when supported by the advisory.
- Service configuration files could be overwritten.
- Arbitrary file writes or deletions are possible.
- Service disruption or unauthorized file modification.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and infrastructure teams are likely responsible for addressing this vulnerability in Dokploy, as it impacts a self-hostable PaaS used for managing deployments. The first practical step is to identify all Dokploy instances, determine their reachability and business criticality, and then confirm the accountable owner to plan remediation activities based on risk.
- Application and infrastructure teams own this.
- Verify Dokploy instance reachability and criticality.
- Plan remediation based on identified risk.
