Horizon Alert
Summary of the vulnerability and why it matters
Docker Desktop Community Edition is affected by a vulnerability that allows local users to gain elevated privileges. This occurs when a low-privilege user places a malicious `docker-credential-wincred.exe` file in a specific program data directory. When an administrator or service account later interacts with Docker, such as by restarting it or logging in, the malicious file is executed, leading to privilege escalation. The impact of this vulnerability can include unauthorized access and control over the affected system, potentially compromising sensitive data and disrupting business operations.
- Vulnerable component: Docker Desktop Community Edition
- Core weakness: Privilege escalation via malicious executable
- Main business impact: Unauthorized system access and control
Attack Path
How an attacker could exploit the issue
This vulnerability allows a local, low-privilege user to escalate privileges on a Windows system. An attacker can place a malicious executable file disguised as a Docker credential helper in a specific program data directory. When an administrator or service user authenticates with Docker, restarts Docker, or runs a login command, the system may execute the malicious file with elevated privileges. This could lead to the compromise of the system or sensitive data.
- Local user places malicious file.
- Admin or service executes it.
- Attacker gains elevated control.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability presents a localized risk to systems running specific versions of Docker Desktop Community Edition on Windows. An attacker with low-level access could potentially escalate privileges by introducing a malicious executable that is then run by an administrative user or service. The business impact could include unauthorized system control or data access if an attacker successfully exploits this vulnerability. Organizations should consider this a heightened risk due to its inclusion in the Known Exploited Vulnerabilities catalog.
- Attackers need local access.
- Malicious file placement required.
- High privilege escalation risk.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability allows a local user to elevate their privileges on affected systems. Attackers can exploit this by placing a malicious executable in a specific directory, which is then executed by system users. This can lead to unauthorized access and control of the system, posing a significant risk to organizational data and operations.
- Identify all systems running affected software.
- Restrict access to the specified program directory.
- Update to the fixed version and confirm resolution.
