GHSA-w9qx-qg64-f8pf: Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook
Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dockhandto a version that resolves this vulnerability.Fixed in 1.0.54
Event History
Frequently Asked Questions
Which Dockhand versions are affected?
Dockhand versions from 1.0.47 up to, but not including, 1.0.54 are affected. Upgrading to 1.0.54 or later removes the affected version range.
What access does an attacker need to retrieve secrets?
An attacker needs either the webhook secret for a stack or a user account with the stacks:start permission. No additional user interaction is required.
Which operations can return the exposed secret values?
The Git stack webhook, manual deploy endpoint, and create-and-deploy endpoint can return the values. These routes return deployStack() results without filtering the resolvedSecrets field.
What types of secrets may be disclosed?
Stored stack secrets and secrets resolved from external providers may be exposed. This includes values sourced from providers such as 1Password or Vault.