Docker Desktop < 4.44.3 Container Escape

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(258110);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-9074");
  script_xref(name:"IAVA", value:"2025-A-0633-S");

  script_name(english:"Docker Desktop < 4.44.3 Container Escape");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a container escape vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Docker Desktop is prior to 4.44.3. It is therefore affected by a container escape vulnerability.
The vulnerability allows local running Linux containers to access the Docker Engine API via the configured Docker
subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI)
enabled, and with or without the 'Expose daemon on tcp://localhost:2375 without TLS' option enabled. This can lead to
execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new
ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows
mounting the host drive with the same privileges as the user running Docker Desktop.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://docs.docker.com/security/security-announcements/#docker-desktop-4443-security-update-cve-2025-9074
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4cd6027e");
  script_set_attribute(attribute:"see_also", value:"https://docs.docker.com/desktop/release-notes/#4443");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Docker Desktop version 4.44.3 or later");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-9074");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:docker:docker");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("docker_for_linux_installed.nbin", "docker_for_mac_installed.nbin", "docker_for_windows_installed.nbin");
  script_require_ports("installed_sw/Docker Desktop", "installed_sw/Docker", "installed_sw/Docker for Windows");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {"spec_version": "1.0"},
  "checks": [
    {
      "product":{'name': "Docker for Windows", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "windows"}}
      ],
      "constraints": [{"fixed_version":"4.44.3"}]
    },
        {
      "product":{"name": "Docker", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "macos"}}
      ],
      "constraints": [{"fixed_version":"4.44.3"}]
    },
        {
      "product":{"name": "Docker Desktop", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "linux"}}
      ],
      "constraints": [{"fixed_version":"4.44.3"}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);