A critical SSRF vulnerability in Dozzle exposes containerized environments to unauthorized internal network access by unauthenticated remote attackers.

This vulnerability is a Server-Side Request Forgery (CWE-918) occurring in the Dozzle log viewer. The flaw permits unauthenticated attackers to send arbitrary requests from the server hosting the container, potentially bypassing network segmentation.

Successful exploitation allows an attacker to interact with internal services that are otherwise protected by a firewall or network perimeter. With a CVSS score of 8.6, this represents a high risk of data exfiltration or internal reconnaissance, potentially leading to a broader compromise of the internal infrastructure.

Immediate Action: Upgrade Dozzle to version 10.5.2 or later to address the underlying flaw. If an immediate update is not feasible, restrict network access to the Dozzle interface using strict IP allowlisting.

Proactive Monitoring: Inspect server logs for unusual outbound traffic patterns originating from the Dozzle container instance.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious outbound requests or unauthorized API calls directed at the service.

Public Exploit Available: No (Nuclei detection template exists).

Given the high CVSS score and the ease of exploitability, organizations must prioritize patching this vulnerability immediately. While no weaponized exploit is currently observed, the existence of detection templates suggests that threat actors are actively creating tools to identify and leverage this flaw.