Docker Desktop for Windows < 4.49.0 Privilege Escalation (CVE-2025-9164)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271961);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-9164");
  script_xref(name:"IAVA", value:"2025-A-0802-S");

  script_name(english:"Docker Desktop for Windows < 4.49.0 Privilege Escalation (CVE-2025-9164)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Docker Desktop for Windows installed on the remote host is prior to 4.49.0. It is, therefore, affected
by a privilege escalation vulnerability:

  - Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches
    for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege
    escalation through malicious DLL placement.This issue affects Docker Desktop: through 4.48.0. (CVE-2025-9164)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://docs.docker.com/security/security-announcements/#docker-desktop-4490-security-update-cve-2025-9164
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?42c74522");
  script_set_attribute(attribute:"see_also", value:"https://docs.docker.com/desktop/release-notes/#4490");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Docker Desktop for Windows version 4.49.0 or later");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-9164");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:docker:docker");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("docker_for_windows_installed.nbin");
  script_require_ports("installed_sw/Docker for Windows");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {"spec_version": "1.0"},
  "checks": [
    {
      "product":{'name': "Docker for Windows", "type": "app"},
      "check_algorithm": "default",
      "requires": [
        {"scope": "target", "match": {"os": "windows"}}
      ],
      "constraints": [{"fixed_version":"4.49.0"}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);