Docker Desktop < 4.67.0 SSRF (CVE-2026-33990)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(304670);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/08");

  script_cve_id("CVE-2026-33990");
  script_xref(name:"IAVA", value:"2026-A-0284-S");

  script_name(english:"Docker Desktop < 4.67.0 SSRF (CVE-2026-33990)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a server-side request forgery vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Docker Desktop installed on the remote host is prior to 4.67.0. It is, therefore, affected by a
server-side request forgery (SSRF) vulnerability:

  - Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model,
    Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme,
    hostname, or IP range. A malicious OCI registry can set the realm to an internal URL, causing Model Runner running
    on the host to make arbitrary GET requests to internal services and reflect the full response body back to the
    caller. (CVE-2026-33990)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/docker/model-runner/security/advisories/GHSA-x2f5-332j-9xwq
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ca9ae58f");
  script_set_attribute(attribute:"see_also", value:"https://docs.docker.com/desktop/release-notes/#4670");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Docker Desktop version 4.67.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-33990");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:docker:docker");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("docker_for_linux_installed.nbin", "docker_for_mac_installed.nbin", "docker_for_windows_installed.nbin");
  script_require_ports("installed_sw/Docker Desktop", "installed_sw/Docker", "installed_sw/Docker for Windows");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Docker for Windows', 'type': 'app'},
      'check_algorithm': 'default',
      'requires': [
        {'scope': 'target', 'match': {'os': 'windows'}}
      ],
      'constraints': [{'fixed_version': '4.67.0'}]
    },
    {
      'product': {'name': 'Docker', 'type': 'app'},
      'check_algorithm': 'default',
      'requires': [
        {'scope': 'target', 'match': {'os': 'macos'}}
      ],
      'constraints': [{'fixed_version': '4.67.0'}]
    },
    {
      'product': {'name': 'Docker Desktop', 'type': 'app'},
      'check_algorithm': 'default',
      'requires': [
        {'scope': 'target', 'match': {'os': 'linux'}}
      ],
      'constraints': [{'fixed_version': '4.67.0'}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);