Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
dokploy:dokploy
References 4
https://github.com/Dokploy/dokploy/security/advisories/GHSA-w6r4-f26v-8g36
https://github.com/Dokploy/dokploy/security/advisories/GHSA-w6r4-f26v-8g36
https://github.com/Dokploy/dokploy/pull/4875
https://github.com/Dokploy/dokploy/pull/4875
https://github.com/Dokploy/dokploy/commit/d3f522b7a6f5100fc0fc0bff5851e48d11d45…
https://github.com/Dokploy/dokploy/commit/d3f522b7a6f5100fc0fc0bff5851e48d11d459e2
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13