PT-2020-12272 · Docker+2 · Docker Desktop Enterprise+3

Hashim Jawad · Published 2020-03-18 · Updated 2022-05-24 · CVE-2020-10665

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Docker Desktop Enterprise versions prior to 2.1.0.9 Docker Desktop for Windows Stable versions prior to 2.2.0.4 Docker Desktop for Windows Edge versions prior to 2.2.2.0 LibreNMS versions prior to 1.48

Description The issue allows for local privilege escalation and arbitrary file writes due to mishandling of diagnostics collection with Administrator privileges. Additionally, there is a problem with insufficient validation or encoding of user-supplied input in graphing scripts, which can lead to injection of RRDtool syntax and various attacks, including disclosure of directory structure and filenames, file content, denial of service, or writing arbitrary files. The html/graph.php script and parameters like html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php are affected.

Recommendations For Docker Desktop Enterprise versions prior to 2.1.0.9, update to version 2.1.0.9 or later. For Docker Desktop for Windows Stable versions prior to 2.2.0.4, update to version 2.2.0.4 or later. For Docker Desktop for Windows Edge versions prior to 2.2.2.0, update to version 2.2.2.0 or later. For LibreNMS versions prior to 1.48, update to version 1.48 or later. As a temporary workaround for LibreNMS, consider restricting access to the html/graph.php script and validating user input for the html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php scripts to prevent RRDtool syntax injection.

Exploit

Fix

LPE

Special Elements Injection

Link Following

Weakness Enumeration

CWE-74

CWE-59

Related Identifiers

CVE-2020-10665

GHSA-Q5RG-WG7H-73M5

Affected Products

Docker Desktop Enterprise

Docker Desktop For Windows

Librenms

Rrdtool

References · 11

• 🔥 https://github.com/spaceraccoon/CVE-2020-10665 · Exploit
• https://osv.dev/vulnerability/CVE-2020-10665 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q5rg-wg7h-73m5 · Vendor Advisory
• https://docs.docker.com/release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10665 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10665 · Security Note
• https://github.com/librenms/librenms · Note
• https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-002.md · Note
• https://activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665 · Note
• https://t.me/cybersecuritytechnologies/1612 · Telegram Post
• https://darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023 · Note