CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 are vulnerable to command injection through the `destination.testConnection` fields, allowing low-privileged users to execute arbitrary commands within the root Dokploy container. This critical vulnerability poses a significant risk as it grants access to the host Docker socket, potentially leading to further exploitation of the host system. Organizations using Dokploy should prioritize upgrading to version 0.29.13 to mitigate this severe security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission("destination", "create")` path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.