PT-2023-7465 · Docker · Docker Desktop

B1Czuo · Published 2023-03-28 · Updated 2023-04-17 · CVE-2023-1802

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Docker Desktop versions 4.17.x

Description The issue is related to the transmission of registry data in plain text due to the use of HTTP instead of HTTPS in the Artifactory module of Docker Desktop. This can allow a remote attacker to gain unauthorized access to sensitive information. A targeted network sniffing attack can lead to the disclosure of sensitive information. The issue affects users who have Access Experimental Features enabled and have logged in to a private registry.

Recommendations For Docker Desktop version 4.17.x, consider disabling the Artifactory Integration until a patch is available to prevent the transmission of registry credentials over plain HTTP. Restrict access to private registries to minimize the risk of exploitation. Avoid using the Access Experimental Features option until the issue is resolved.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2023-08508

CVE-2023-1802

Affected Products

Docker Desktop

References · 7

• 🔥 https://github.com/docker/for-win/issues/13344 · Exploit
• https://osv.dev/vulnerability/CVE-2023-1802 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08508 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-1802 · Security Note
• https://vuldb.com/ru/?id.225096 · Note
• https://t.me/cibsecurity/61545 · Telegram Post
• https://docs.docker.com/desktop/release-notes/#4180 · Note