CyberRota Analysis
AI-GeneratedThe Mousehole service in Docker versions prior to 0.4.05 is vulnerable due to a lack of application-layer authentication, allowing unauthorized clients to access sensitive session cookies and manipulate WebSocket state updates. This could lead to session hijacking and unauthorized control over the seedbox management interface. Organizations using affected versions of Docker should prioritize upgrading to version 0.4.05 or later to mitigate these risks, especially those operating in mixed-trust environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie in state and reuses the same cookie-bearing serialization for persisted state, public API responses, and WebSocket state updates. Any client that can reach the published Mousehole port can read cookie-bearing state, connect to WebSocket state updates, replace the stored cookie, or force MAM update side effects. The deployment examples publish port 5010 broadly with Docker's `5010:5010` syntax, which can make the issue reachable on mixed-trust LAN/VPN interfaces. Version 0.4.0 patches the issue.