SecBoard
Zurück zur CVE-Übersicht

CVE-2026-72740

CRITICAL(9.9)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.9 — Kritisch

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.9

Technische Schwere

Beschreibung

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.

Erkennung & Indikatoren

Ausnutzung

Confirmed via out-of-band code execution (Burp Collaborator)

Behobene Versionen

  • 0.29.13

Threat-Hunting-Queries

This vulnerability involves OS command injection during service deployment when a user-controlled customGitUrl (SSH variant) is processed. Detection should focus on monitoring for unusual shell command executions originating from the Dokploy host, specifically commands like 'ssh-keyscan' or 'git clone' that contain unexpected or malicious subcommands/metacharacters. Look for processes spawned by t

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "node" or InitiatingProcessFileName =~ "dokploy"
| where FileName =~ "sh" or FileName =~ "bash" or FileName =~ "powershell.exe"
| where ProcessCommandLine has "ssh-keyscan" or ProcessCommandLine has "git clone"
| where ProcessCommandLine matches regex @'\$\([\s\S]*\)' or ProcessCommandLine matches regex @'`[\s\S]*`' or ProcessCommandLine has "&&" or ProcessCommandLine has "||" or ProcessCommandLine has ";"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName

Splunk SPL

index=* (sourcetype=linux_audit OR sourcetype=ms:eventlog:security)
| (process="node" OR process="dokploy") (command="sh" OR command="bash" OR command="powershell.exe")
| search (commandline="*ssh-keyscan*" OR commandline="*git clone*") (commandline="*$(*" OR commandline="*`*`" OR commandline="*&&*" OR commandline="*||*" OR commandline="*;*")
| table _time, host, user, process, commandline

Sigma

title: Dokploy OS Command Injection Attempt
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith: 
      - '\node'
      - '\dokploy'
    Image|endswith:
      - '\sh'
      - '\bash'
      - '\powershell.exe'
    CommandLine|contains:
      - 'ssh-keyscan'
      - 'git clone'
    CommandLine|contains_any:
      - '$('
      - '`'
      - '&&'
      - '||'
      - ';'
  condition: selection
level: critical

Elastic ES|QL

from process where 
  (process.parent.executable : "node" or process.parent.executable : "dokploy") and 
  (process.executable : "sh" or process.executable : "bash" or process.executable : "powershell.exe") and 
  (process.args : "ssh-keyscan" or process.args : "git clone") and 
  (process.args : "$(" or process.args : "`" or process.args : "&&" or process.args : "||" or process.args : ";")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • 47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen