SecBoard
Zurück zur CVE-Übersicht

CVE-2026-72867

CRITICAL(9.9)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.9 — Kritisch

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.9

Technische Schwere

Beschreibung

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • v0.29.13

Threat-Hunting-Queries

Überwachung von 'execAsync' und 'execAsyncRemote' Aufrufen in Dokploy-Serverprozessen, insbesondere wenn diese mit Benutzereingaben aus Git-Feldern (customGitUrl, branch names, repo owner/name, gitlab namespace, SSH hostname) kombiniert werden. Achten Sie auf ungewöhnliche Shell-Befehle oder Prozessketten, die auf eine OS Command Injection hindeuten könnten.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "execAsync" or InitiatingProcessCommandLine contains "execAsyncRemote"
| where InitiatingProcessFileName contains "node" or InitiatingProcessFileName contains "dokploy"
| where ProcessCommandLine contains "git clone" and (ProcessCommandLine contains "--branch" or ProcessCommandLine contains "ssh-keyscan")
| where ProcessCommandLine matches regex @'\$\{[^}]+\}' // Look for unescaped variables
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath

Splunk SPL

index=your_dokploy_logs (execAsync OR execAsyncRemote) (source="*providers/git.ts" OR source="*providers/github.ts" OR source="*providers/gitlab.ts" OR source="*providers/bitbucket.ts" OR source="*providers/gitea.ts") "git clone" | regex _raw="\$\{[^}]+\}" | table _time, host, source, _raw

Sigma

title: Dokploy OS Command Injection Attempt
status: experimental
description: Detects potential OS command injection attempts in Dokploy by monitoring 'git clone' commands with unescaped user input.
author: SecBoard
date: 2026/07/22
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: 'node'
    Image|endswith: 'git'
    CommandLine|contains: 'git clone'
    CommandLine|re: '\$\{[^}]+\}' # Look for unescaped variables
  condition: selection
level: high

Elastic ES|QL

FROM process
| WHERE event.category == "process"
| WHERE process.parent.executable == "node" OR process.parent.name == "dokploy"
| WHERE process.executable == "git"
| WHERE process.command_line LIKE "%git clone%"
| WHERE process.command_line =~ /\$\{[^}]+\}/ 
| SELECT @timestamp, host.name, process.parent.command_line, process.command_line, process.executable, process.working_directory

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • 47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen