Docker Engine 28.2 < 28.3.3 Local Docker Ports Exposed to Network

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(243284);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2025-54388");
  script_xref(name:"IAVA", value:"2025-A-0560-S");

  script_name(english:"Docker Engine 28.2 < 28.3.3 Local Docker Ports Exposed to Network");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a vulnerability that exposes local ports to the network.");
  script_set_attribute(attribute:"description", value:
"The version of the Docker Engine (Moby) installed on the remote host is between 28.2.0 to 28.3.2 It is therefore 
affected by an vulnerability that exposes local ports to the network. When the firewalld service is reloaded it 
removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, 
versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that 
after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from 
remote machines that have network routing to the Docker bridge, even though they should only be accessible from the 
host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This 
issue is fixed in version 28.3.3.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-x4rx-4gw3-53p4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Docker Engine version 28.3.3 or later");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:S/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-54388");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:docker:docker");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("docker_for_linux_installed.nbin");
  script_require_keys("installed_sw/Docker");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product':{'name': 'Docker', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [{'min_version':'28.2', 'fixed_version': '28.3.3'}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);