CVE-2019-15752
published 2019-08-28CVE-2019-15752: Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in…
PriorityP180high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
29.63%
98.0th percentile
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | geode | — | — |
| debian | docker.io | — | — |
| docker | docker | < 2.1.0.1 | 2.1.0.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for file creation events targeting %PROGRAMDATA%\DockerDesktop\version-bin\docker-credential-wincred.exe by non-administrative (low-privilege) users, which is the core exploitation primitive for this CVE. ↗
- →Alert on any process spawned from %PROGRAMDATA%\DockerDesktop\version-bin\docker-credential-wincred.exe that was not written by a privileged account, especially if the parent process is a Docker service or admin session. ↗
- →Flag Metasploit exploit module activity targeting this path: modules/exploits/windows/local/docker_credential_wincred.rb — presence of this module in use indicates active exploitation attempts. ↗
- →Check Docker version via 'docker -v'; versions at or below 18.09.0 (Docker Desktop Community Edition before 2.1.0.1) are flagged as vulnerable by the Metasploit check method. ↗
- ·The Metasploit module will abort exploitation if UAC is set to 'Always Notify' (UAC_PROMPT_CREDS_IF_SECURE_DESKTOP or UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP), meaning this attack vector is blocked in high-UAC environments. ↗
- ·The exploit requires an existing low-privilege Meterpreter session (SessionTypes: meterpreter) and relies on a privileged user subsequently running 'docker login', restarting Docker, or authenticating — making it a time-delayed, user-interaction-dependent privilege escalation. ↗
- ·The PROGRAMDATA option defaults to '%PROGRAMDATA%' and must resolve to the correct Docker version-bin path; if the directory does not exist, the module fails with 'Vulnerable Docker path is not on system'. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_debian7.8LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pg68-prcj-h956: Docker Desktop Community Edition before 2
ghsa_unreviewed·2022-05-24
CVE-2019-15752 [HIGH] CWE-732 GHSA-pg68-prcj-h956: Docker Desktop Community Edition before 2
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
VulnCheck
Docker Desktop Community Edition Privilege Escalation Vulnerability
vulncheck·2019·CVSS 7.8
CVE-2019-15752 [HIGH] CWE-732 Docker Desktop Community Edition Privilege Escalation Vulnerability
Docker Desktop Community Edition Privilege Escalation Vulnerability
Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\.
Affected: Docker Desktop Community Edition
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-05-03
CISA
Docker Desktop Community Edition Privilege Escalation Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2019-15752 [HIGH] CWE-732 Docker Desktop Community Edition Privilege Escalation Vulnerability
Vulnerability: Docker Desktop Community Edition Privilege Escalation Vulnerability
Affected: Docker Desktop Community Edition
Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-15752
Remediation Due Date: 2022-05-03
Debian
CVE-2019-15752: docker.io - Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privi...
vendor_debian·2019·CVSS 7.8
CVE-2019-15752 [HIGH] CVE-2019-15752: docker.io - Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privi...
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
Exploit-DB
Docker-Credential-Wincred.exe - Privilege Escalation (Metasploit)
exploitdb·2020-04-28
CVE-2019-15752 Docker-Credential-Wincred.exe - Privilege Escalation (Metasploit)
Docker-Credential-Wincred.exe - Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Docker-Credential-Wincred.exe Privilege Escalation',
'Description' => %q{
This exploit leverages a vulnerability in docker desktop
community editions prior to 2.1.0.1 where an attacker can write
a payload to a lower-privileged area to be executed
automatically by the docker user at login.
},
'License' => MSF_LICENSE,
'Author' => [
'Morgan Roman', # discovery
'bwatters-r7', # metasploit module
],
'Platform' => ['win'],
'SessionTypes' => ['meterpreter'],
'Targets' => [[ 'Automatic', {} ]],
'DefaultTarget' => 0,
'DefaultOptions' => {
'WfsDelay' => 15
},
'Disclos
Metasploit
Docker-Credential-Wincred.exe Privilege Escalation
metasploit
Docker-Credential-Wincred.exe Privilege Escalation
Docker-Credential-Wincred.exe Privilege Escalation
This exploit leverages a vulnerability in docker desktop community editions prior to 2.1.0.1 where an attacker can write a payload to a lower-privileged area to be executed automatically by the docker user at login.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/157404/Docker-Credential-Wincred.exe-Privilege-Escalation.htmlhttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Ehttps://medium.com/%40morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478ehttp://packetstormsecurity.com/files/157404/Docker-Credential-Wincred.exe-Privilege-Escalation.htmlhttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Ehttps://medium.com/%40morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478ehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15752
2019-08-28
Published
2021-11-03
Added to CISA KEV
Exploited in the wild