Dozzle, a realtime log viewer for Docker containers, had a security flaw in versions before 10.5.2 where the WebSocket upgrader's origin check was effectively disabled by always returning true. This allowed any origin to initiate WebSocket connections to sensitive endpoints (/exec and /attach). Because the JWT authentication cookie uses SameSite: Lax, an attacker hosting a page on a same-site origin (such as a sibling subdomain or localhost service) could leverage the victim's valid JWT cookie to hijack the WebSocket connection. This results in unauthorized interactive shell access to containers the victim is authorized to access. The vulnerability is identified as CWE-346 (Origin Validation Error) and is rated with a CVSS 4.0 score of 8.7 (high severity). The issue is resolved in Dozzle version 10.5.2.

Exploitation of this vulnerability allows an attacker on a same-site origin to hijack WebSocket connections authenticated by the victim's JWT cookie, gaining interactive shell access to Docker containers the victim can access. This compromises container integrity and confidentiality, potentially leading to unauthorized command execution within containers.

Upgrade Dozzle to version 10.5.2 or later, where the origin validation issue in the WebSocket upgrader is fixed. No other mitigations are indicated. Patch status is not explicitly confirmed in vendor advisory content, but the fix is stated to be in version 10.5.2.