Docker Desktop < 4.41.0 Information Disclosure Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(235123);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2025-3911");
  script_xref(name:"IAVA", value:"2026-A-0181-S");

  script_name(english:"Docker Desktop < 4.41.0 Information Disclosure Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Docker Desktop for Linux is prior to 4.41.0. It is therefore affected by an information disclosure vulnerability.
The Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to 
unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to 
these logs could obtain sensitive credentials information and further use it to gain unauthorized access to other systems. 
Starting with version 4.41.0, Docker Desktop no longer logs environment variables set by the user.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Docker Desktop version 4.41.0 or later");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-3911");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/04/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:docker:docker");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("docker_for_linux_installed.nbin", "docker_for_mac_installed.nbin", "docker_for_windows_installed.nbin");
  script_require_ports("installed_sw/Docker Desktop", "installed_sw/Docker", "MacOSX/packages/sys_profiler", "installed_sw/Docker for Windows", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {"spec_version": "1.0"},
  "checks": [
    {
      "product":{'name': "Docker for Windows", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "windows"}}
      ],
      "constraints": [{"fixed_version":"4.41.0"}]
    },
        {
      "product":{"name": "Docker", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "macos"}}
      ],
      "constraints": [{"fixed_version":"4.41.0"}]
    },
        {
      "product":{"name": "Docker Desktop", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "linux"}}
      ],
      "constraints": [{"fixed_version":"4.41.0"}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);