CVE-2026-58455: Critical Dockwatch RCE via Unauthenticated Command Injection — Detection and Hardening

---
title: Dockwatch composePull Command Injection Attempt
id: 9c2b3d4e-1f5a-4b8c-9e0d-1a2b3c4d5e6f
status: experimental
description: Detects potential exploitation of CVE-2026-58455 via POST requests to ajax/compose.php with composePull action.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-58455
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.web_shell
  - cve-2026-58455
logsource:
  category: web
  product: apache
  # Or nginx, iis, etc - adjust based on env
detection:
  selection:
    Method: POST
    cs-uri-query|contains: 'ajax/compose.php'
    cs-uri-query|contains: 'composePull'
    cs-uri-query|contains: 'composePath'
  condition: selection
falsepositives:
  - Legitimate administrative use of Dockwatch compose features
level: high
---
title: Web Server Spawning Shell Indicator
id: 8a1b2c3d-4e5f-6789-0a1b-2c3d4e5f6789
status: experimental
description: Detects suspicious process execution where a web server (PHP/Apache/Nginx) spawns a shell, indicative of RCE.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-58455
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/dash'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative scripts executed via web interface (rare)
level: critical

// Hunt for suspicious ajax/compose.php requests indicating CVE-2026-58455 exploitation
// Adjust table names based on your log source (CommonSecurityLog, Syslog, DeviceNetworkEvents)
let WebEvents = materialize (
    CommonSecurityLog
    | where RequestProtocol in ("HTTP", "HTTPS")
    | where RequestMethod =~ "POST"
    | where RequestURL has "ajax/compose.php"
    | where RequestURL has "composePull"
    | extend ExtraFields = parse_(AdditionalExtensions)
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, UserAgent
);
// Correlate with potential process execution on the Linux host (if CEF/OMS agent is installed)
let ProcessEvents = materialize (
    DeviceProcessEvents
    | where Timestamp > ago(1d)
    | where InitiatingProcessFileName in ("apache2", "httpd", "nginx", "php-fpm")
    | where FileName in ("sh", "bash", "dash")
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
);
WebEvents
| join kind=inner (ProcessEvents) on $left.DestinationIP == $right.DeviceIP
| project TimeGenerated, SourceIP, DeviceName, RequestURL, ProcessCommandLine

-- Hunt for web servers spawning shells (RCE indicator)
SELECT Pid, Ppid, Name, Exe, Username, StartTime, CommandLine
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ 'apache' OR Name =~ 'httpd' OR Name =~ 'nginx' OR Name =~ 'php'
)
AND Name =~ 'sh'

-- Check for vulnerable Dockwatch container images
SELECT ContainerId, Image, ImageID, Created, Command, State
FROM containers()
WHERE Image =~ 'dockwatch'
-- Note: Specific version regex parsing from image tags may be required for exact ID match

#!/bin/bash

# CVE-2026-58455 Remediation Script
# Identifies vulnerable Dockwatch containers and checks Docker socket mounts

echo "[*] Scanning for vulnerable Dockwatch instances (CVE-2026-58455)..."

# Find running Dockwatch containers
VULNERABLE_CONTAINERS=$(docker ps --filter "ancestor=dockwatch" --format "{{.ID}}")

if [ -z "$VULNERABLE_CONTAINERS" ]; then
    echo "[+] No running Dockwatch containers found based on ancestor name."
else
    echo "[!] WARNING: Found Dockwatch containers running. Check versions manually."
    docker ps --filter "ancestor=dockwatch" --format "table {{.ID}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"
    
    echo "[!] Checking for Docker socket mounts..."
    for CONTAINER_ID in $VULNERABLE_CONTAINERS; do
        MOUNTS=$(docker inspect --format='{{range .Mounts}}{{if eq .Destination "/var/run/docker.sock"}}{{.Source}}{{end}}{{end}}' $CONTAINER_ID)
        if [ ! -z "$MOUNTS" ]; then
            echo "[CRITICAL] Container $CONTAINER_ID has Docker socket mounted at $MOUNTS. This increases risk significantly."
        fi
    done
fi

echo "[*] Recommended Actions:"
echo "1. Update Dockwatch to version > 0.6.567 immediately."
echo "2. If immediate patching is impossible, stop the container: docker stop <container_id>"
echo "3. Review network exposure; ensure Dockwatch is not accessible from the public internet."
echo "4. If updating, pull the latest image: docker pull dockwatch:latest"

Update Dockwatch to the latest version immediately. Versions **0.6.567 and below** are vulnerable. Verify with your vendor that the updated version addresses the `loader.php` logic flaw and sanitizes inputs in `ajax/compose.php`.