Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 Nuclei template
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
The Docker-Proxy project's hubcmdui component, which provides its web management interface, is affected. An unauthenticated attacker could read and change its configuration, exposing stored secrets such as messaging bot tokens and webhook URLs and allowing them to redirect alerts and alter links and proxy settings.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- dqzboy Docker-Proxy
through 5.1.9