CVE-2019-15752
Docker Desktop Community Edition Privilege Escalation Vulnerability
Description
CVE-2019-15752 is a HIGH severity privilege escalation vulnerability in Docker Desktop Community Edition before version 2.1.0.1, classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The flaw allows local users to gain elevated privileges by placing a trojan horse docker-credential-wincred.exe file in the %PROGRAMDATA%\DockerDesktop\version-bin\ directory. With a CVSS 3.1 score of 7.8, this vulnerability enables a low-privileged local user to escalate to administrative or SYSTEM-level privileges when an administrator or service user subsequently authenticates with Docker or restarts the Docker service. CISA added CVE-2019-15752 to its KEV catalog on November 3, 2021. The EPSS score of 0.46851 (97.62th percentile) indicates a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| docker | docker | < 2.1.0.1 |
| apache | geode | 1.12.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157404/Docker-Credential-Wincred.exe-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E(Mailing List)
- https://medium.com/%40morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478e(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15752(US Government Resource)
Weakness Type
CWE-732: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource occurs when software sets permissions for a critical resource in a way that allows unintended actors to read, modify, or execute it. This is particularly dangerous when the resource is loaded or executed by a more privileged process, as it creates a privilege escalation path. The weakness typically manifests in file system permissions, where a low-privileged user can write to directories that are later read or executed by high-privileged processes.
In the context of CVE-2019-15752, Docker Desktop Community Edition before 2.1.0.1 used the %PROGRAMDATA%\DockerDesktop\version-bin\ directory to store executable files that were loaded during Docker operations. The permissions on this directory allowed low-privileged users to write files to it. When a Docker administrator or the Docker service executed operations that loaded executables from this directory, the attacker-placed trojan horse file was executed with the administrator's or SYSTEM's privileges, completing the privilege escalation.
Learn more: CWE-732 — Incorrect Permission Assignment for Critical Resource
Impact Analysis
CVE-2019-15752 carries a CVSS 3.1 base score of 7.8 (HIGH) with local attack characteristics.
Confidentiality (High): Successful exploitation elevates the attacker from a low-privileged local user to an administrator or SYSTEM-level account. This provides access to all data on the system, including credentials stored by other users, Docker secrets and configuration files, container images that may contain sensitive application data, and any files protected by access control lists that restrict low-privileged users.
Integrity (High): With elevated privileges, the attacker can modify any file on the system, install persistent backdoors, modify Docker configurations and container images, tamper with system binaries, and alter security settings. The attacker can also modify Docker images in the local repository, potentially injecting malicious code into containers that are subsequently deployed.
Availability (High): The attacker can disrupt Docker services and any containerized applications running on the host. With SYSTEM-level access, the attacker can stop services, delete critical files, corrupt Docker images and volumes, or render the entire system inoperable. The impact extends to all containers and services managed by the compromised Docker installation.
Scope (Unchanged): The vulnerability scope remains within the Docker host system. The EPSS score of 0.46851 (97.62th percentile) reflects a high exploitation probability, placing it in the top 2.4% of all CVEs.
Exploit Maturity
Active Exploitation: CVE-2019-15752 is actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on November 3, 2021, with a mandatory remediation deadline of May 3, 2022 for federal agencies.
Public Exploits: A detailed exploit demonstrating the privilege escalation technique is publicly available on Packet Storm Security. The exploit shows how to place a malicious executable in the writable directory and wait for a privileged Docker operation to trigger its execution.
Exploitation Simplicity: The attack is straightforward to execute. A low-privileged user creates a malicious docker-credential-wincred.exe file and copies it to %PROGRAMDATA%\DockerDesktop\version-bin. No special tools or complex exploit chains are required. The attacker simply waits for any administrative user to run Docker commands or for the Docker service to restart.
EPSS Context: The EPSS score of 0.46851 (97.62th percentile) indicates high exploitation probability. While the local access requirement limits the attack surface compared to network-exploitable vulnerabilities, the simplicity of exploitation and wide Docker deployment make this a significant risk in multi-user environments.
KEV Deadline: Federal agencies were required to apply remediation by May 3, 2022.
Remediation
-
Upgrade Docker Desktop to version 2.1.0.1 or later immediately. The update corrects the file permissions on the version-bin directory to prevent low-privileged users from writing executable files. Download the latest Docker Desktop from the official Docker website.
-
Audit the version-bin directory for suspicious files. Check %PROGRAMDATA%\DockerDesktop\version-bin\ for any unexpected executable files, particularly docker-credential-wincred.exe files with recent modification dates or unusual file sizes. Compare file hashes against known good Docker binaries.
-
Restrict directory permissions manually as an interim measure. If immediate upgrading is not possible, modify the ACLs on %PROGRAMDATA%\DockerDesktop\version-bin\ to remove write access for non-administrative users. Ensure only the SYSTEM account and Administrators group have write permissions.
-
Review system logs for evidence of exploitation. Check Windows Security Event Logs for process creation events involving docker-credential-wincred.exe, especially instances launched by privileged accounts. Look for unexpected child processes spawned by Docker-related executables.
-
Implement application whitelisting. Deploy Windows AppLocker or similar application control solutions to prevent unauthorized executables from running in the DockerDesktop directories. Create rules that only allow signed Docker binaries to execute from these paths.
-
Limit Docker host access to trusted users. In multi-user environments, restrict local login access to Docker host systems. Ensure that only users who require Docker access have login privileges on machines running Docker Desktop.
Technical Details
CVE-2019-15752 is a local privilege escalation vulnerability in Docker Desktop Community Edition before version 2.1.0.1 on Windows. The vulnerability exists in the file permission configuration of the %PROGRAMDATA%\DockerDesktop\version-bin\ directory, which stores executable files used by Docker during various operations including credential management.
The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local access is required, the attack complexity is low, no special privileges are needed to place the malicious file, but user interaction is required in the form of an administrator performing a Docker operation. The high impact across confidentiality, integrity, and availability reflects the complete system compromise possible when the escalation succeeds.
The attack exploits the fact that %PROGRAMDATA% directories on Windows are often writable by standard users. Docker Desktop stored its credential helper executable (docker-credential-wincred.exe) in a subdirectory under %PROGRAMDATA% without properly restricting write access. A low-privileged user can replace or pre-place a malicious executable with the same filename in this directory.
When a Docker administrator or the Docker service executes operations that require credential management, such as running "docker login", pulling images from authenticated registries, or restarting the Docker daemon, the system loads docker-credential-wincred.exe from the version-bin directory. Because the attacker has replaced this file with a trojan horse version, the malicious code executes with the calling user's elevated privileges.
The vulnerability was publicly disclosed through a detailed write-up that explained the discovery process, the underlying permission misconfiguration, and the exploitation technique. Apache Geode version 1.12.0 was also noted as affected because it bundled a vulnerable version of Docker in its test infrastructure.
Frequently Asked Questions
Is CVE-2019-15752 being actively exploited?
Yes, CVE-2019-15752 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021. A public exploit demonstrating the privilege escalation technique is available on Packet Storm Security, and the attack requires minimal technical skill to execute on systems with vulnerable Docker Desktop installations.
What products are affected by CVE-2019-15752?
Docker Desktop Community Edition versions before 2.1.0.1 on Windows are the primary affected product. Additionally, Apache Geode version 1.12.0 is affected because it included a vulnerable Docker version in its testing infrastructure. Any Windows system running an affected Docker Desktop version where multiple users have local access is at risk.
How do I fix CVE-2019-15752?
Upgrade Docker Desktop to version 2.1.0.1 or later. After upgrading, audit the %PROGRAMDATA%\DockerDesktop\version-bin\ directory for any suspicious executables that may have been placed there by an attacker. Review system logs for evidence of the malicious executable having been run by privileged accounts.
How severe is CVE-2019-15752?
CVE-2019-15752 is rated HIGH with a CVSS score of 7.8. The vulnerability allows local privilege escalation from a standard user to administrator or SYSTEM-level access on Windows systems running Docker Desktop. While the local access requirement limits the attack surface, the simplicity of exploitation and the EPSS score of 0.46851 (97.62th percentile) indicate significant real-world risk, particularly in enterprise environments where multiple users share Docker host systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.