Docker Desktop < 4.43.0 Information Disclosure

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(300035);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2025-6587");
  script_xref(name:"IAVA", value:"2026-A-0181-S");

  script_name(english:"Docker Desktop < 4.43.0 Information Disclosure");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Docker Desktop is prior to 4.43.0. It is therefore affected by an information disclosure vulnerability.

  - System environment variables are recorded in Docker Desktop diagnostic logs, when using shell 
    auto-completion. This leads to unintentional disclosure of sensitive information such as api keys, 
    passwords, etc.  A malicious actor with read access to these logs could obtain secrets and further use 
    them to gain unauthorized access to other systems. Starting with version 4.43.0 Docker Desktop no longer 
    logs system environment variables as part of diagnostics log collection. (CVE-2025-6587)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://docs.docker.com/security/security-announcements/");
  script_set_attribute(attribute:"see_also", value:"https://docs.docker.com/desktop/release-notes/#4430");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Docker Desktop version 4.43.0 or later");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-6587");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:docker:docker");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("docker_for_linux_installed.nbin", "docker_for_mac_installed.nbin", "docker_for_windows_installed.nbin");
  script_require_ports("installed_sw/Docker Desktop", "installed_sw/Docker", "installed_sw/Docker for Windows");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {"spec_version": "1.0"},
  "checks": [
    {
      "product":{'name': "Docker for Windows", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "windows"}}
      ],
      "constraints": [{"fixed_version":"4.43.0"}]
    },
        {
      "product":{"name": "Docker", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "macos"}}
      ],
      "constraints": [{"fixed_version":"4.43.0"}]
    },
        {
      "product":{"name": "Docker Desktop", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "linux"}}
      ],
      "constraints": [{"fixed_version":"4.43.0"}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);