Description (CNA)
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Docker / Docker CLI | unaffected 29.2.0 |
| Docker / Compose | unaffected 5.1.0 |
CWE
CWE-427
References
- https://docs.docker.com/desktop/release-notes/
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/
- https://github.com/docker/cli/pull/6713
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Docker CLI for Windows. A low-privileged attacker can exploit this vulnerability by creating a specific directory, C:\ProgramData\Docker\cli-plugins, which does not exist by default. By placing malicious plugin binaries in this directory, an attacker can achieve privilege escalation when a victim user opens Docker Desktop or uses Docker CLI plugin features, provided the Docker CLI is executed with elevated privileges.