{"items":[{"id":"NVI-00018575","kind":"vulnerability","title":"Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-j643-x8pv-8m67","CVE-2026-44985"],"plain_summary":"GitHub lists this reviewed advisory for github.com/amir20/dozzle. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3f008a2a2f961c55bbae1320a3ed9bc1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-08T23:35:14.000Z","value":"9.6 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3f008a2a2f961c55bbae1320a3ed9bc1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3f008a2a2f961c55bbae1320a3ed9bc1","url":"https://github.com/advisories/GHSA-j643-x8pv-8m67","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-j643-x8pv-8m67","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:50:36.189Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3f008a2a2f961c55bbae1320a3ed9bc1"],"technology":"github.com/amir20/dozzle","known_exclusions":[],"conditions_summary":"## Summary\n\nThe WebSocket upgrader for the `/exec` and `/attach` endpoints uses `CheckOrigin: func(r *http.Request) bool { return true }`, accepting upgrade requests from any origin. Combined with the JWT cookie using `SameSite: Lax`, this enables Cross-Site WebSocket Hijacking (CSWSH) — **even when authentication is properly configured**.\n\nAn attacker hosting a page on a same-site origin (e.g., a sibling subdomain, or another service on localhost) can initiate a WebSocket connection to the exec endpoint that carries the victim's valid JWT cookie, gaining interactive shell access in any container the victim is authorized to access.\n\n## Root cause\n\n**1. CheckOrigin bypassed (`internal/web/terminal.go:15-21`)**\n\n```go\nvar upgrader = websocket.Upgrader{\n    ReadBufferSize:  1024,\n    WriteBufferSize: 1024,\n    CheckOrigin: func(r *http.Request) bool {\n        return true\n    },\n}\n```\n\nThe gorilla/websocket default CheckOrigin rejects cross-origin requests. Overriding it to return `true` removes the only server-side defense against CSWSH.\n\n**2. JWT cookie with SameSite=Lax (`internal/web/auth.go:20-27`)**\n\n```go\nhttp.SetCookie(w, &http.Cookie{\n    Name:     \"jwt\",\n    Value:    token,\n","public_affected_ranges":["<= 10.5.1"]}],"null_published_at":"2026-11-07T07:07:39.857Z","source_updated_at":"2026-06-08T23:35:14.000Z","source_disclosed_at":"2026-05-11T14:07:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:50:36.189Z"}],"next_cursor":null,"snapshot_revision":"42594"}