Summary
Dokku contains a command-injection vulnerability in the docker-options plugin because stored option strings are later concatenated into DOCKER_ARGS and evaluated by Bash. An attacker with app-level Dokku access and remote SSH access to execute docker-options commands may run arbitrary commands on the host with the privileges of the dokku operating-system user.
Dokku contains a command-injection vulnerability in the docker-options plugin because stored option strings are later concatenated into DOCKER_ARGS and evaluated by Bash. An attacker with app-level Dokku access and remote SSH access to execute docker-options commands may run arbitrary commands on the host with the privileges of the dokku operating-system user.
Affected context
The vulnerability occurs in Dokku deployments where:
- A user has app-level Dokku access.
- The user can connect through SSH and invoke
docker-optionscommands. - Docker option values are stored and later incorporated into
DOCKER_ARGS. - Build, deploy, or run operations process those values through Bash evaluation.
Risk depends on the permissions available to the dokku operating-system account and the host resources reachable from that account.
The vulnerability occurs in Dokku deployments where:
- A user has app-level Dokku access.
- The user can connect through SSH and invoke
docker-optionscommands. - Docker option values are stored and later incorporated into
DOCKER_ARGS. - Build, deploy, or run operations process those values through Bash evaluation.
Risk depends on the permissions available to the dokku operating-system account and the host resources reachable from that account.
Exploit preconditions
- Attack surface: Dokku's remote SSH command interface and docker-options plugin.
- Required access: App-level Dokku permissions plus SSH access sufficient to execute docker-options commands.
- Trigger point: A subsequent build, deploy, or run operation that processes the stored Docker arguments.
- Why exploitation is possible: User-controlled strings are concatenated into a shell command and interpreted by Bash rather than treated strictly as data.
- Attack surface: Dokku's remote SSH command interface and docker-options plugin.
- Required access: App-level Dokku permissions plus SSH access sufficient to execute docker-options commands.
- Trigger point: A subsequent build, deploy, or run operation that processes the stored Docker arguments.
- Why exploitation is possible: User-controlled strings are concatenated into a shell command and interpreted by Bash rather than treated strictly as data.
Why this happens
The underlying flaw is shell command injection caused by combining attacker-influenced strings with command construction and Bash eval.
When values stored through the docker-options plugin are later placed in DOCKER_ARGS, shell metacharacters and command substitutions can be interpreted as executable shell syntax. This behavior maps to CWE-95: Improper Neutralization of Directives in Dynamically-Evaluated Code, because data is incorporated into dynamically evaluated commands without preserving a strict data-only boundary.
The underlying flaw is shell command injection caused by combining attacker-influenced strings with command construction and Bash eval.
When values stored through the docker-options plugin are later placed in DOCKER_ARGS, shell metacharacters and command substitutions can be interpreted as executable shell syntax. This behavior maps to CWE-95: Improper Neutralization of Directives in Dynamically-Evaluated Code, because data is incorporated into dynamically evaluated commands without preserving a strict data-only boundary.
Potential impact
- An attacker may execute arbitrary commands on the Dokku host.
- The attacker could read, alter, or delete data accessible to the
dokkuuser. - Application deployments, builds, or runtime behavior may be tampered with.
- Credentials, environment data, or service configuration may be exposed.
- The host could be used for lateral movement or further privilege escalation.
- An attacker may execute arbitrary commands on the Dokku host.
- The attacker could read, alter, or delete data accessible to the
dokkuuser. - Application deployments, builds, or runtime behavior may be tampered with.
- Credentials, environment data, or service configuration may be exposed.
- The host could be used for lateral movement or further privilege escalation.
General mitigation guidance
Mitigation generally focuses on removing dynamic shell evaluation and treating Docker options as structured data rather than command fragments.
Common defensive patterns include:
- Avoiding Bash
evaland equivalent dynamic command execution for user-influenced values. - Passing arguments through structured process APIs that preserve argument boundaries.
- Allowing only explicitly supported Docker options and validating values against strict schemas.
- Reducing the trust granted to app-level users and SSH command interfaces.
- Running Dokku operations with least privilege and isolating sensitive host resources.
- Preventing secrets and host credentials from being unnecessarily exposed to build or deploy processes.
Mitigation generally focuses on removing dynamic shell evaluation and treating Docker options as structured data rather than command fragments.
Common defensive patterns include:
- Avoiding Bash
evaland equivalent dynamic command execution for user-influenced values. - Passing arguments through structured process APIs that preserve argument boundaries.
- Allowing only explicitly supported Docker options and validating values against strict schemas.
- Reducing the trust granted to app-level users and SSH command interfaces.
- Running Dokku operations with least privilege and isolating sensitive host resources.
- Preventing secrets and host credentials from being unnecessarily exposed to build or deploy processes.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying
eval, shell interpolation, and concatenation of external input into commands. - Code review checks for environment variables or argument arrays assembled from user-controlled configuration.
- Tests using metacharacter-like inputs to verify that values remain arguments rather than executable syntax.
- SSH and Dokku audit logs showing unexpected docker-options changes followed by build, deploy, or run activity.
- Policy enforcement that restricts dynamic shell execution and requires structured subprocess APIs.
Automated security and code-review tools may help identify unsafe command-construction patterns before deployment.
Organizations can look for this class of issue through:
- Static analysis rules identifying
eval, shell interpolation, and concatenation of external input into commands. - Code review checks for environment variables or argument arrays assembled from user-controlled configuration.
- Tests using metacharacter-like inputs to verify that values remain arguments rather than executable syntax.
- SSH and Dokku audit logs showing unexpected docker-options changes followed by build, deploy, or run activity.
- Policy enforcement that restricts dynamic shell execution and requires structured subprocess APIs.
Automated security and code-review tools may help identify unsafe command-construction patterns before deployment.
