Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided commit 5563699f71b2058b49eebdfd66c6c3dbd92ede9c reveals two distinct but related vulnerabilities.
Firstly, several functions within apps/dokploy/server/api/routers/swarm.ts (swarmRouter.getNodes, swarmRouter.getNodeInfo, swarmRouter.getNodeApps, and swarmRouter.getAppInfos) were vulnerable to Insecure Direct Object Reference (IDOR). The patch introduces a new function, assertServerInActiveOrg, which is called at the beginning of each of these query functions. This new function verifies that the serverId provided in the input belongs to the caller's activeOrganizationId. In the vulnerable version, this check was absent, allowing an authenticated attacker with server:read permission to query information about servers belonging to other organizations by simply supplying a different serverId.
Secondly, the getNodeInfo function located in packages/server/src/services/docker.ts was susceptible to OS Command Injection. The patch shows that the nodeId variable, which is user-controlled, was directly concatenated into a shell command string (docker node inspect ${nodeId} --format '{{json .}}'). The fix involves wrapping nodeId with quote([]) from the shell-quote library, which properly escapes the input to prevent command injection. In the vulnerable state, a malicious nodeId could have contained shell metacharacters, allowing an attacker to execute arbitrary commands on the server where the Docker daemon is running, potentially leading to root Remote Code Execution (RCE) as described in the vulnerability details.
swarmRouter.getNodesapps/dokploy/server/api/routers/swarm.ts
swarmRouter.getNodeInfoapps/dokploy/server/api/routers/swarm.ts
swarmRouter.getNodeAppsapps/dokploy/server/api/routers/swarm.ts
swarmRouter.getAppInfosapps/dokploy/server/api/routers/swarm.ts
getNodeInfopackages/server/src/services/docker.ts