Eviatar Gerzi

**Name of the Vulnerable Software and Affected Versions** Docker Desktop for Windows versions prior to 4.6 **Description** The issue is related to a race condition in the start() function of the WindowsContainerStartRequest class in Docker Desktop for Windows, allowing an attacker to exploit a symlink vulnerability. This can be achieved by controlling the `data-root` field inside the `DaemonJSON` field, enabling the attacker to overwrite any file through the "windowscontainers/start" `dockerBackendV2` API endpoint. The exploitation is possible due to a TOCTOU (Time-of-Check-to-Time-of-Use) race condition, affecting the `..dataRoot etworkfileslocal-kv.db` file. **Recommendations** For Docker Desktop for Windows versions prior to 4.6, update to version 4.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the `windowscontainers/start` `dockerBackendV2` API endpoint until a patch is applied. Avoid using the `data-root` field inside the `DaemonJSON` field in the WindowsContainerStartRequest class until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Docker Desktop versions prior to 4.6.0 **Description** The issue is related to errors in handling symbolic links within the `settings.DataFolder` variable in the Docker Desktop for Windows platform. This can allow a remote attacker to gain read, modify, or delete access to data. The vulnerability can be exploited through the "hyperv/destroy" dockerBackendV2 API endpoint by using a symlink in the `DataFolder` parameter. **Recommendations** For Docker Desktop versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `DataFolder` parameter in the affected API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** kubernetes (affected versions not specified) **Description** The issue is related to the handling of raw data output to a terminal by kubectl. Specifically, it does not neutralize escape, meta, or control sequences contained in this data. This affects unstructured string fields in objects such as Events. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Secdo for Windows (affected versions not specified) **Description** The issue is related to improper input validation, allowing an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:) to cause a system crash on every login. This can be exploited by an attacker to add data to the root directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Secdo for Windows (affected versions not specified) **Description** The issue is related to incorrect default permissions on the C:ProgramdataSecdoLogs folder in Secdo, allowing local authenticated users to overwrite system files and gain escalated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Secdo for Windows (affected versions not specified) **Description** The issue is due to insufficient input validation, allowing a local authenticated user with 'create folders or append data' access to the root of the OS disk (C:) to gain system privileges if a specific hardcoded path does not already exist or is writable. This can be exploited by creating folders or adding data to the root of the OS disk, potentially leading to elevated system privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.