Dockhand Unauthenticated Admin Password Reset via Static-Asset Auth Bypass

Vulnerability Overview Title: Unauthenticated Admin Password Reset via Static-Asset Auth Bypass Description: Summary: In Dockhand, an authentication bypass vulnerability allows any unauthenticated remote attacker to reset the password of the administrator user (or any local user) and take over the account. The root cause is an early-return check for "static assets" that runs before the global auth hook. This check matches any path ending with , , etc. (including routes). Combined with a failed authorization check in the user mutation API handler, this results in unrestricted access. Details: - Bug 1: Static asset check bypasses authentication ( ) - Code snippet: - Explanation: Because this check runs before session/Bearer validation and short-circuits with , any path ending in (or , , , , , ) reaches the SvelteKit route without authentication and without being set. - The SvelteKit route maps to the handler , where . The handler then executes , which corresponds to the administrator user (id=1). The same technique applies to any user: . - Bug 2: Failed authorization in the user mutation handler ( ) - When the request is unauthenticated, returns , causing the permission gate to be skipped (fail-open): - Explanation: Since / is / for unauthenticated callers, no guards trigger, and the handler proceeds to modify the user record. Crucially, the password change is not protected by an check—an unauthenticated caller can set a new password for the administrator (or any user). - This mutation is also visible via (using the same bypass), which returns the target user record. Why the bypass is complete: - The only thing preventing unauthenticated requests from reaching these fail-open handlers was the 401 gate in the global hook. Bug 1 removes this gate for any path ending in , and Bug 2 removes the permission checks in the handler for unauthenticated callers. Together, they allow a single HTTP request to achieve full account takeover. Scope of Impact Affected Versions: <= v1.0.44 Fixed Version: v1.0.45 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High CVSS v3 Score: 10.0 / 10 CVSS v3 Vector: CVE ID: No known CVE Weaknesses: - CWE-284 - CWE-287 - CWE-306 - CWE-863 Impact: - Vulnerability Type: Incorrect Authentication / Incorrect Authorization (Authentication bypass leading to Account Takeover) - Attack Surface: Remote, Unauthenticated — requires no credentials, no user interaction, and no special conditions. - Who is Affected: Any self-hosted Dockhand instance with authentication enabled and at least one local user. A single unauthenticated request resets the administrator password, granting full admin access to the Web Application (all users, settings, Docker operations). The attacker can also delete the last administrator to globally disable authentication, permanently locking out the operator. Remediation Fixed Version: v1.0.45 Proof of Concept (POC) Code Step 1 — Unauthenticated Admin Password Reset via Static Asset Bypass Step 2 — Confirm Takeover by Logging In with the Attacker-Selected Password The attacker now holds a valid administrator session. Step 3 — (Optional, More Severe) Unauthenticated Disabling of Authentication Non-Destructive Confirmation (No Password Change) — Verify Bypass Allows Writing to Admin Record

Goal Reached Thanks to every supporter — we hit 100%!

Dockhand Unauthenticated Admin Password Reset via Static-Asset Auth Bypass

More from this source