Merge pull request #4858 from Dokploy/fix/idor-swarm-cross-org

fix(security): cross-org IDOR + nodeId injection in swarm read endpoints

apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts

@@ -0,0 +1,41 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// Mirrors how getNodeInfo builds its command in services/docker.ts:
+//   `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
+// We swap `docker node inspect` for `:` (a no-op) so the test only exercises
+// whether the nodeId payload can break out of the command, not real docker.
+const buildCommand = (nodeId: string) =>
+	`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
+
+const INJECTION_NODE_IDS = [
+	"$(touch %MARK%)",
+	"`touch %MARK%`",
+	"; touch %MARK%",
+	"abc | touch %MARK%",
+	"&& touch %MARK%",
+];
+
+describe("getNodeInfo nodeId command injection", () => {
+	it("does not execute injected commands from the nodeId", () => {
+		const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
+		for (const template of INJECTION_NODE_IDS) {
+			if (existsSync(mark)) rmSync(mark);
+			const nodeId = template.replace("%MARK%", mark);
+			try {
+				execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
+			} catch {
+				// A non-zero exit from the no-op is fine; we only care about the marker.
+			}
+			expect(existsSync(mark)).toBe(false);
+		}
+		if (existsSync(mark)) rmSync(mark);
+	});
+
+	it("keeps a legitimate node id intact as a single literal token", () => {
+		const nodeId = "abc123def456";
+		expect(quote([nodeId])).toBe(nodeId);
+	});
+});

apps/dokploy/server/api/routers/swarm.ts

@@ -18,12 +18,30 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to access this server",
+					});
+				}
+			}
 			return await getSwarmNodes(input.serverId);
 		}),
 	getNodeInfo: withPermission("server", "read")
 		.input(z.object({ nodeId: z.string(), serverId: z.string().optional() }))
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to access this server",
+					});
+				}
+			}
 			return await getNodeInfo(input.nodeId, input.serverId);
 		}),
 	getNodeApps: withPermission("server", "read")
@@ -32,7 +50,16 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to access this server",
+					});
+				}
+			}
 			return getNodeApplications(input.serverId);
 		}),
 	getAppInfos: withPermission("server", "read")
@@ -54,7 +81,16 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to access this server",
+					});
+				}
+			}
 			return await getApplicationInfo(input.appName, input.serverId);
 		}),
 	getContainerStats: withPermission("server", "read")

packages/server/src/services/docker.ts

@@ -2,6 +2,7 @@ import {
 	execAsync,
 	execAsyncRemote,
 } from "@dokploy/server/utils/process/execAsync";
+import { quote } from "shell-quote";
 
 export const getContainers = async (serverId?: string | null) => {
 	try {
@@ -519,7 +520,7 @@ export const getSwarmNodes = async (serverId?: string) => {
 
 export const getNodeInfo = async (nodeId: string, serverId?: string) => {
 	try {
-		const command = `docker node inspect ${nodeId} --format '{{json .}}'`;
+		const command = `docker node inspect ${quote([nodeId])} --format '{{json .}}'`;
 		let stdout = "";
 		let stderr = "";
 		if (serverId) {