CVE-2019-15752
Docker Desktop Community Edition — Docker Desktop Community Edition Privilege Escalation Vulnerability
Description
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2019-15752 carries a CVSS 7.8 score (AV:L/AC:L/PR:N/UI:R) and sits at the 98th EPSS percentile, indicating that working exploit code is widely available and active exploitation is highly probable. The attack requires no prior privileged access — a low-privileged local user simply drops a trojanised binary into a world-writable directory and waits for an administrator or service account to trigger it through a routine Docker operation. For NIS2-regulated organisations with Windows-based developer workstations or CI/CD pipelines, the risk is elevated because these systems are typically less hardened than servers yet hold access to source code, secrets, and internal network segments. CISA has not flagged known ransomware campaign use, but the extreme EPSS percentile justifies treating this as a critical patch priority — target remediation within 24 hours on any internet-connected or multi-user Windows host running Docker Desktop.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the vendor patch: Upgrade Docker Desktop Community Edition to version 2.1.0.1 or later. The patch is available from Docker — consult the official Docker release advisory for the exact download URL and installer hash.
- Lock the vulnerable directory immediately: Remove write permissions for non-privileged users on
%PROGRAMDATA%\DockerDesktop\version-bin\. Only SYSTEM and local Administrators should retain write access. - Audit existing binaries: Hash all files in
%PROGRAMDATA%\DockerDesktop\version-bin\and compare against known-good values from a clean reference installation. Prioritisedocker-credential-wincred.exe. - Suppress the trigger action: Until the patch is deployed, prohibit or strictly schedule administrative
docker logincalls and Docker service restarts on affected hosts — these are the actions that cause the trojanised binary to execute with elevated privileges. - Isolate affected endpoints: Move developer workstations and CI/CD build agents running Docker Desktop < 2.1.0.1 into a restricted network segment until patching is complete.
Runbook · Step 2
Mitigation layers
- Filesystem hardening (endpoint): Use Group Policy or an SCCM script to enforce a restrictive DACL on
%PROGRAMDATA%\DockerDesktop\version-bin\:icacls "%PROGRAMDATA%\DockerDesktop\version-bin" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F". This removes write access for standard users entirely. - AppLocker / WDAC publisher rule: Allow execution of binaries from
%PROGRAMDATA%\DockerDesktop\version-bin\only when signed by the Docker publisher certificate. This blocks an unsigned or re-signed trojan horse from running even if it is placed in the directory. - Least-privilege (IAM): Restrict Docker Desktop usage to accounts that do not hold local administrator rights. Verify that Docker services run under a dedicated service account with the minimum required privileges.
- EDR behavioural rule: Configure a block-or-alert rule that fires when
docker-credential-wincred.exeis launched from%PROGRAMDATA%\DockerDesktop\version-bin\by any parent process other than a known, signed Docker service binary. - Network segmentation: Separate developer workstations running Docker Desktop from production networks and privileged management systems to limit the blast radius of a successful local privilege escalation.
Runbook · Step 3
Detection rules
- Sysmon EID 11 (FileCreate) + EID 1 (ProcessCreate): Alert when a file named
docker-credential-wincred.exeis created in%PROGRAMDATA%\DockerDesktop\version-bin\by a process running at Medium or Low integrity level.Sigma-Shape: EventID=11 AND TargetFilename CONTAINS 'DockerDesktop\version-bin\docker-credential-wincred.exe' AND IntegrityLevel IN ('Medium','Low') - Sysmon EID 1 — process ancestry: Alert when
docker-credential-wincred.exestarts and the parent image is notdockerd.exeor another known Docker service binary.Sigma-Shape: EventID=1 AND Image ENDSWITH 'docker-credential-wincred.exe' AND NOT ParentImage ENDSWITH 'dockerd.exe' - Windows Security EID 4663 (object access): Place a SACL on
%PROGRAMDATA%\DockerDesktop\version-bin\; alert on EID 4663 withAccessMask 0x2(WRITE_DATA) by any account other than SYSTEM or Administrators. - EDR hash deviation: Set up continuous hash monitoring of
docker-credential-wincred.exeagainst the reference SHA256 from the official Docker installer. Any deviation should trigger an immediate high-severity alert. - KQL (Microsoft Sentinel / Defender for Endpoint):
DeviceFileEvents | where FolderPath contains "DockerDesktop\\version-bin" and FileName == "docker-credential-wincred.exe" and InitiatingProcessAccountType != "System"
Metrics
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
apache
geode
docker
docker2.1.0.1
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- https://medium.com/%40morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478ex_refsource_MISC
- http://packetstormsecurity.com/files/157404/Docker-Credential-Wincred.exe-Privilege-Escalation.htmlx_refsource_MISC
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Emailing-listx_refsource_MLIST
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15752government-resource