Docker Desktop for Windows Local Privilege Escalation Vulnerability (CVE-2019-15752)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2019-15752) arises from insecure default permission settings (CWE-732) in Docker Desktop Community Edition for Windows. The %PROGRAMDATA%\DockerDesktop\version-bin\ directory incorrectly grants write permissions to low-privileged local users. When Docker Desktop services or administrative processes attempt to authenticate or manage credentials, they execute helper binaries from this directory without verifying the integrity or absolute path of the executable.

2. Exploitation Mechanics & Attack Scenario

An attacker with local access to the Windows system can exploit this vulnerability through the following steps:

• The attacker drops a malicious payload named docker-credential-wincred.exe into the %PROGRAMDATA%\DockerDesktop\version-bin\ directory.
• The attacker waits for an administrator or a system service to trigger Docker authentication, restart the Docker service, or execute the docker login command.
• Due to the search order and lack of validation, the Docker service executes the attacker's Trojan horse binary with elevated privileges (SYSTEM or Administrator), resulting in local privilege escalation.

3. Infrastructure & Business Impact

As a CISA KEV-listed vulnerability, this flaw poses a significant risk to enterprise environments. In shared developer environments or multi-user Windows workstations, a compromise of a low-privilege developer account can be easily leveraged to gain full control over the host operating system. This facilitates lateral movement, credential harvesting, and potential compromise of the active directory domain.