mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-07-27 16:55:25 +02:00
5563699f71
swarm.getNodes/getNodeInfo/getNodeApps/getAppInfos accepted a caller-supplied
serverId and ran remote Docker Swarm reads against it with no organization
check, exposing another tenant's swarm topology cross-org (getContainerStats
already had the check; the others did not). getNodeInfo additionally
interpolated nodeId unescaped into 'docker node inspect ${nodeId}'.
Adds an org-ownership assertion to the four unscoped handlers and passes nodeId
through shell-quote in getNodeInfo.
Closes GHSA-jj6h-388v-9rwm
42 lines
1.4 KiB
TypeScript
42 lines
1.4 KiB
TypeScript
import { execSync } from "node:child_process";
|
|
import { existsSync, rmSync } from "node:fs";
|
|
import { quote } from "shell-quote";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
// Mirrors how getNodeInfo builds its command in services/docker.ts:
|
|
// `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
|
|
// We swap `docker node inspect` for `:` (a no-op) so the test only exercises
|
|
// whether the nodeId payload can break out of the command, not real docker.
|
|
const buildCommand = (nodeId: string) =>
|
|
`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
|
|
|
|
const INJECTION_NODE_IDS = [
|
|
"$(touch %MARK%)",
|
|
"`touch %MARK%`",
|
|
"; touch %MARK%",
|
|
"abc | touch %MARK%",
|
|
"&& touch %MARK%",
|
|
];
|
|
|
|
describe("getNodeInfo nodeId command injection", () => {
|
|
it("does not execute injected commands from the nodeId", () => {
|
|
const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
|
|
for (const template of INJECTION_NODE_IDS) {
|
|
if (existsSync(mark)) rmSync(mark);
|
|
const nodeId = template.replace("%MARK%", mark);
|
|
try {
|
|
execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
|
|
} catch {
|
|
// A non-zero exit from the no-op is fine; we only care about the marker.
|
|
}
|
|
expect(existsSync(mark)).toBe(false);
|
|
}
|
|
if (existsSync(mark)) rmSync(mark);
|
|
});
|
|
|
|
it("keeps a legitimate node id intact as a single literal token", () => {
|
|
const nodeId = "abc123def456";
|
|
expect(quote([nodeId])).toBe(nodeId);
|
|
});
|
|
});
|