Dockwatch Unauthenticated OS Command Injection (Auth Bypass + shell_exec RCE)

Technical Analysis

The vulnerability chains two flaws: an incomplete authentication check in loader.php that fails to terminate execution after redirecting unauthenticated users, allowing a required session flag to be seeded regardless of auth status, and unsanitized user input flowing into shell_exec() within ajax/compose.php's composePull action via the composePath POST parameter. This combination allows unauthenticated remote attackers to execute arbitrary OS commands with the privileges of the web server process, rated CVSS 9.8 (critical) due to network-based, low-complexity, no-privilege-required exploitation with full confidentiality, integrity, and availability impact. Because Dockwatch is standardly deployed with the Docker socket mounted into its container, RCE translates directly into host-level Docker API access, enabling attackers to spawn privileged containers, escape to the host, or manipulate any other containers under Dockwatch's management. Organizations running AI agent orchestration, RAG pipelines, or LLM tool-calling infrastructure in Docker environments monitored by Dockwatch face direct risk: compromise of the Docker socket allows attackers to pivot into agent containers, exfiltrate API keys, model weights, or vector store credentials, and tamper with agent behavior or tool execution at the infrastructure level.

Affected Systems

Dockwatch versions up to and including 0.6.567; deployments with default configuration exposing loader.php and ajax/compose.php; installations where the Docker socket (/var/run/docker.sock) is mounted into the Dockwatch container

Indicators of Compromise

• POST requests to /ajax/compose.php with action=composePull
• composePath parameter containing shell metacharacters (;, |, &&, $(), backticks)
• Unexpected access to loader.php without valid session followed by immediate compose.php requests
• Unauthorized docker.sock API calls originating from Dockwatch container process

Remediation Steps

1. 1

   Upgrade Dockwatch

   Update to a patched Dockwatch release beyond 0.6.567 as soon as it is available from the vendor; monitor vendor advisories closely.

2. 2

   Restrict Network Access

   Immediately restrict access to the Dockwatch web interface to trusted internal networks or VPN only; do not expose it directly to the internet.

3. 3

   Remove or Limit Docker Socket Mount

   Avoid mounting the Docker socket directly into the Dockwatch container; use a socket proxy (e.g., docker-socket-proxy) with least-privilege API access instead.

4. 4

   Web Application Firewall Rules

   Deploy WAF rules to block requests to ajax/compose.php containing shell metacharacters in the composePath parameter.

5. 5

   Audit and Rotate Credentials

   Audit host and container logs for signs of exploitation, and rotate any API keys, secrets, or credentials accessible from the Dockwatch host or adjacent containers, including those used by AI agent or LLM tooling.

6. 6

   Enable Authentication Enforcement

   Implement additional reverse-proxy-level authentication in front of Dockwatch as defense-in-depth until a patch is applied.