Docker Desktop < 4.57.0 Privilege Escalation

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(298648);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/16");

  script_cve_id("CVE-2025-14740");
  script_xref(name:"IAVA", value:"2026-A-0137-S");

  script_name(english:"Docker Desktop < 4.57.0 Privilege Escalation");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Docker Desktop is prior to 4.57.0. It is therefore affected by a privilege escalation vulnerability.

  - This vulnerability allows local attackers to escalate privileges on affected installations of Docker 
    Desktop for Windows. User interaction on the part of an administrator is required to exploit this 
    vulnerability. The specific flaw exists within the product installer. The issue results from incorrect 
    permissions on a folder. An attacker can leverage this vulnerability to escalate privileges and execute 
    arbitrary code in the context of a target user. (CVE-2025-14740)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.zerodayinitiative.com/advisories/ZDI-CAN-28190/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ce68f2f");
  # https://www.zerodayinitiative.com/advisories/ZDI-CAN-28542/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?28312ba1");
  script_set_attribute(attribute:"see_also", value:"https://docs.docker.com/desktop/release-notes/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Docker Desktop version 4.57.0 or later");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-14740");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:docker:docker");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("docker_for_windows_installed.nbin");
  script_require_ports("installed_sw/Docker for Windows");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {"spec_version": "1.0"},
  "requires": [
    {"scope": "target", "match": {"os": "windows"}}
  ],
  "checks": [
    {
      "product":{"name": "Docker for Windows", "type": "app"},
      "check_algorithm": "default",
      "constraints": [{"fixed_version": "4.57.0"}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);