Docker Desktop 4.46.0 < 4.47.0 Container Escape

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(269979);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/18");

  script_cve_id("CVE-2025-10657");
  script_xref(name:"IAVA", value:"2025-A-0724-S");

  script_name(english:"Docker Desktop 4.46.0 < 4.47.0 Container Escape");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a container escape vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Docker Desktop is prior to 4.47.0. It is therefore affected by a container escape vulnerability.
In a hardened Docker environment, with Enhanced Container Isolation ( ECI https://docs.docker.com/enterprise/security/
hardened-desktop/enhanced-container-isolation/ ) enabled, an administrator can utilize the command restrictions feature 
https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/config/#command-restrictions  
to restrict commands that a container with a Docker socket mount may issue on that socket. Due to a software bug, the 
configuration to restrict commands was ignored when passed to ECI, allowing any command to be executed on the socket. 
This grants excessive privileges by permitting unrestricted access to powerful Docker commands. The vulnerability 
affects only Docker Desktop 4.46.0 users that have ECI enabled and are using the Docker socket command restrictions 
feature. In addition, since ECI restricts mounting the Docker socket into containers by default, it only affects 
containers which are explicitly allowed by the administrator to mount the Docker socket.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://docs.docker.com/security/security-announcements/#docker-desktop-4443-security-update-CVE-2025-10657
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8a15d7ad");
  script_set_attribute(attribute:"see_also", value:"https://docs.docker.com/desktop/release-notes/#4470");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Docker Desktop version 4.47.0 or later");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-10657");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:docker:docker");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("docker_for_linux_installed.nbin", "docker_for_mac_installed.nbin", "docker_for_windows_installed.nbin");
  script_require_ports("installed_sw/Docker Desktop", "installed_sw/Docker", "installed_sw/Docker for Windows");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {"spec_version": "1.0"},
  "checks": [
    {
      "product":{'name': "Docker for Windows", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "windows"}}
      ],
      "constraints": [{"fixed_version":"4.47.0"}]
    },
        {
      "product":{"name": "Docker", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "macos"}}
      ],
      "constraints": [{"fixed_version":"4.47.0"}]
    },
        {
      "product":{"name": "Docker Desktop", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "linux"}}
      ],
      "constraints": [{"fixed_version":"4.47.0"}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);