CVE-2019-15752

Docker Desktop Community Edition for Windows runs its credential helper, docker-credential-wincred.exe, from the %PROGRAMDATA%\DockerDesktop\version-bin\ folder, which by default is writable by unprivileged users (CWE-732, incorrect default permissions). A local attacker can plant a trojan-horse copy of that file in the folder, and when Docker Desktop subsequently invokes it, the attacker's code runs with the elevated privileges under which Docker Desktop executes. Successful exploitation yields local privilege escalation to administrator-level code execution on the workstation, but it requires the attacker to already hold a non-admin local foothold on the machine. Anyone running Docker Desktop Community Edition on Windows is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog as of 2021-11-03, indicating known in-the-wild exploitation, with EPSS assigning a 31.9% probability of exploitation in the next 30 days; no public proof-of-concept is known and ransomware use is unknown.

What to do: Update Docker Desktop Community Edition to the latest release per the vendor's instructions, as required by CISA's KEV listing. Until patched, check %PROGRAMDATA%\DockerDesktop\version-bin\ for unexpected, unsigned, or recently modified docker-credential-wincred.exe files and restrict write access to that folder to Administrators. Prioritize hosts where multiple local accounts share the machine, since exploitation requires an unprivileged local foothold.