CVE-2019-15752

What is Docker Desktop?

Docker Desktop is the packaged distribution of Docker for Windows and macOS developer workstations, bundling the Docker Engine, CLI, and supporting services such as credential helpers that securely store registry authentication tokens. Because Docker Desktop installs several helper executables that run with elevated privileges during startup and image operations, weaknesses in how those helpers are located and loaded can be leveraged for local privilege escalation.

Overview

CVE-2019-15752 is a local privilege escalation vulnerability in Docker Desktop Community Edition for Windows. The flaw allows a local, low-privileged user to place a malicious file named docker-credential-wincred.exe into %PROGRAMDATA%\DockerDesktop\version-bin\, a directory with weak permissions. Because a privileged Docker Desktop process later loads and executes the helper binary from that path, the attacker's trojan horse executable runs with elevated privileges instead of the legitimate credential helper. CVSS 3.1 base score 7.8 (High).

Technical Details

This is CWE-732 (Incorrect Permission Assignment for Critical Resource). The %PROGRAMDATA%\DockerDesktop\version-bin\ directory did not have file-system permissions restrictive enough to prevent a standard user from writing or replacing files inside it. Docker Desktop's update/versioning mechanism trusted whatever binary was present at that path and executed it with the higher privileges the Desktop service itself holds, resulting in classic binary-planting privilege escalation: attacker-controlled code runs as a more privileged user simply by winning a race to place a file in a writable, trusted location.

Discovery

The issue was identified and fixed by Docker as part of the Docker Desktop Community Edition release cycle; public Docker security advisories do not attribute the discovery to a specific named external researcher for this CVE.

Exploitation Context

CISA added CVE-2019-15752 to the KEV catalog in November 2021, confirming it has been used in real-world attacks. Local privilege-escalation bugs on developer workstations are particularly attractive to attackers, since developer machines often hold source-code access, cloud credentials, and CI/CD secrets — escalating from a low-privileged foothold to administrator on such a machine can significantly expand an intrusion's blast radius.

Remediation

1. Update Docker Desktop Community Edition to a version beyond the one affected by CVE-2019-15752 — check Docker's release notes for the specific fixed build.
2. Verify and tighten file-system permissions on %PROGRAMDATA%\DockerDesktop\version-bin\ so standard users cannot write to it.
3. Run endpoint protection that flags unexpected binary creation or replacement in Docker Desktop's installation directories.
4. Apply least-privilege principles to developer workstations, limiting standard users' ability to write into ProgramData-rooted application directories generally.
5. Audit developer machines running outdated Docker Desktop builds and prioritize updates on systems with access to sensitive credentials or source repositories.