CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 are vulnerable due to improper handling of the databaseName parameter in the backup.restoreBackupWithLogs tRPC subscription, allowing authenticated users with backup:restore permissions to execute arbitrary commands in the Docker-privileged host context. This critical vulnerability poses a significant risk to systems running MongoDB and Docker, enabling potential takeover of the host environment. Organizations utilizing Dokploy should prioritize upgrading to version 0.29.13 to mitigate this severe security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docker exec, resulting in arbitrary commands running in the Docker-privileged host context. This issue is fixed in version 0.29.13.