CISA Issues Update on Dokploy OS Command Injection

Dokploy versions 0.29.8 and 0.29.11, and commit 24b02f5 on the canary branch, contain an OS command injection issue in the database backup creation and restoration functions. With the default setup that runs the Dokploy process with root privileges, exploitation can result in full compromise of the target device.

The Dokploy platform provides authenticated users the ability to create and schedule database backups and to restore previously created backups. Backup operations run by the Dokploy process execute with root privileges by default. The vulnerability is caused by insufficient sanitization of user-controlled input before it is incorporated into shell commands. The backup functionality constructs database-specific shell commands by directly interpolating a user-supplied database name, while the restore functionality incorporates a user-supplied backupFile value into a shell command. Both operations pass the resulting command to a shell execution helper that invokes /bin/bash as a child of the Dokploy process without shell escaping or restrictions on shell metacharacters. The parameters are exposed through tRPC procedures that validate only that supplied values are non-empty strings, allowing authenticated users with backup permission to provide shell metacharacters interpreted by /bin/bash for arbitrary command execution on the Dokploy host with the Dokploy server process privileges.

With an authenticated Dokploy account that has backup permission, an attacker can execute arbitrary commands as root on the Dokploy host under the default configuration. Successful exploitation provides full control of the host, including persistent read/write access to the target server’s filesystem and the ability to steal private credentials stored for other tenants managed by the same Dokploy instance. The issue affects all five database types supported by Dokploy: PostgreSQL, MySQL, MariaDB, MongoDB, and LibSQL. Exploitation was confirmed against versions 0.29.8 and 0.29.11, and commit 24b02f5 on the canary branch.

Dokploy could not be reached to coordinate the vulnerability, but the issue has been patched in Dokploy versions 0.29.13 and beyond. CERT/CC recommends users update immediately. For database administrators or general operators unable to update, the documented mitigation is to turn off default backup permissions and restrict backup permissions only to necessary users and roles.

Thanks to Muhammadjon Ahmadjonov for reporting the vulnerability. The document was written by Alex Lewis, and it includes references to Dokploy canary source files and related commits, including GitHub URLs for backups and restore utilities and an exec helper, as well as a referenced commit ccd2e83c5.

Blog post, originally published by Alex Lewis at kb.cert.org.