Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-21 22:05:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce org-scope on swarm reads and escape nodeId

Browse Source 
swarm.getNodes/getNodeInfo/getNodeApps/getAppInfos accepted a caller-supplied
serverId and ran remote Docker Swarm reads against it with no organization
check, exposing another tenant's swarm topology cross-org (getContainerStats
already had the check; the others did not). getNodeInfo additionally
interpolated nodeId unescaped into 'docker node inspect ${nodeId}'.

Adds an org-ownership assertion to the four unscoped handlers and passes nodeId
through shell-quote in getNodeInfo.

Closes GHSA-jj6h-388v-9rwm
This commit is contained in:
Mauricio Siu
2026-07-19 21:20:47 -06:00
parent 74811073f6
commit 5563699f71
3 changed files with 80 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
apps/dokploy/server/api/routers/swarm.ts
View File

@@ -11,6 +11,23 @@ import { z } from "zod";
import { createTRPCRouter, withPermission } from "../trpc";
import { containerIdRegex } from "./docker";
// Ensures a caller-supplied serverId belongs to the caller's active
// organization before any Swarm read runs against it. Without this, the
// server-scoped read procedures were reachable cross-organization (IDOR).
const assertServerInActiveOrg = async (
serverId: string | undefined,
activeOrganizationId: string | undefined,
) => {
if (!serverId) return;
const server = await findServerById(serverId);
if (server.organizationId !== activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to access this server",
});
}
};
export const swarmRouter = createTRPCRouter({
getNodes: withPermission("server", "read")
.input(
@@ -18,12 +35,20 @@ export const swarmRouter = createTRPCRouter({
serverId: z.string().optional(),
}),
)
.query(async ({ input }) => {
.query(async ({ input, ctx }) => {
await assertServerInActiveOrg(
input.serverId,
ctx.session?.activeOrganizationId,
);
return await getSwarmNodes(input.serverId);
}),
getNodeInfo: withPermission("server", "read")
.input(z.object({ nodeId: z.string(), serverId: z.string().optional() }))
.query(async ({ input }) => {
.query(async ({ input, ctx }) => {
await assertServerInActiveOrg(
input.serverId,
ctx.session?.activeOrganizationId,
);
return await getNodeInfo(input.nodeId, input.serverId);
}),
getNodeApps: withPermission("server", "read")
@@ -32,7 +57,11 @@ export const swarmRouter = createTRPCRouter({
serverId: z.string().optional(),
}),
)
.query(async ({ input }) => {
.query(async ({ input, ctx }) => {
await assertServerInActiveOrg(
input.serverId,
ctx.session?.activeOrganizationId,
);
return getNodeApplications(input.serverId);
}),
getAppInfos: withPermission("server", "read")
@@ -54,7 +83,11 @@ export const swarmRouter = createTRPCRouter({
serverId: z.string().optional(),
}),
)
.query(async ({ input }) => {
.query(async ({ input, ctx }) => {
await assertServerInActiveOrg(
input.serverId,
ctx.session?.activeOrganizationId,
);
return await getApplicationInfo(input.appName, input.serverId);
}),
getContainerStats: withPermission("server", "read")