PT-2019-6133 · Docker · Docker Desktop Community Edition+1

Published 2019-07-05 · Updated 2024-07-25 · CVE-2019-15752

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Docker Desktop Community Edition versions prior to 2.1.0.1

Description The issue is related to incorrect permission assignment for the docker-credential-wincred.exe file in the %PROGRAMDATA%DockerDesktopversion-bin folder. This could allow a remote attacker to elevate their privileges. A local user can gain privileges by placing a malicious docker-credential-wincred.exe file in the specified folder and waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login'.

Recommendations For Docker Desktop Community Edition versions prior to 2.1.0.1, update to version 2.1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the docker-credential-wincred.exe file in the %PROGRAMDATA%DockerDesktopversion-bin folder to prevent unauthorized modifications.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2021-05918

CVE-2019-15752

Affected Products

Docker

Docker Desktop Community Edition

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/docker_credential_wincred.rb · Exploit
• 🔥 https://exploit-db.com/exploits/48388 · Exploit
• 🔥 http://packetstormsecurity.com/files/157404/Docker-Credential-Wincred.exe-Privilege-Escalation.html · Exploit
• 🔥 https://medium.com/@morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478e · Exploit
• 🔥 https://medium.com/%40morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478e · Exploit
• https://osv.dev/vulnerability/CVE-2019-15752 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05918 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-15752 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-15752 · Vendor Advisory
• https://twitter.com/Cyberipman/status/1706787622692008176 · Twitter Post
• https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E · Note
• https://t.me/cvenotify/87437 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15752 · Note
• https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E · Note