CyberRota Analysis
AI-GeneratedDokploy versions 0.29.8 and earlier are vulnerable due to improper validation of organization IDs in backup-related API endpoints, allowing authenticated users with backup permissions to access and manipulate backup data across different organizations. This critical vulnerability can lead to unauthorized disclosure of S3 credentials and potential data breaches, making it imperative for all Dokploy users to prioritize immediate updates to secure their environments. Organizations utilizing Dokploy for backup services should assess their exposure and implement necessary patches to mitigate risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's service host, read that organization's backup objects, or redirect and poison backups across tenant boundaries.