"According to security researcher Felix Boulet, the vulnerability has to do with how it's possible for a container to connect to the Docker Engine API at 192.168.65[.]7:2375 without requiring any authentication, thereby opening the door to a scenario where a privileged container could gain full access to the underlying host upon mounting the C:\ drive into it. In a proof-of-concept (PoC) exploit, a web request from any container has been found to trigger the flaw and result in a full compromise of the host -"
"In a proof-of-concept (PoC) exploit, a web request from any container has been found to trigger the flaw and result in a full compromise of the host - POST a JSON payload to "/containers/create," binding the host C:\ drive to a folder in the container (/mnt/host/c:/host_root) in the container, and using a startup command to write or read anything under /host_root on container startup."
A critical vulnerability (CVE-2025-9074) in Docker Desktop for Windows and macOS allowed containers to access the Docker Engine API at 192.168.65[.]7:2375 without authentication. A malicious container could create and launch additional containers and bind the host C:\ drive into a container, enabling full host compromise and unauthorized access to user files. A proof-of-concept exploit demonstrated sending a JSON payload to /containers/create to bind C:\ into /host_root and then POSTing to /containers/{id}/start to execute the container. The flaw scores 9.3 CVSS and is fixed in Docker Desktop 4.44.3; Enhanced Container Isolation does not mitigate it.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]