Docker CLI for Windows Privilege Escalation Vulnerability via Malicious CLI Plugins

A vulnerability exists in Docker CLI for Windows, specifically in versions through 29.1.5, allowing low-privileged attackers to execute malicious CLI plugins. The issue arises because the Docker CLI searches for plugin binaries in a directory that does not exist by default. An attacker can create this directory and place harmful binaries, such as docker-compose.exe or docker-buildx.exe, which are executed when the user opens Docker Desktop or uses Docker CLI plugin features. This could lead to privilege escalation if Docker CLI is run as a privileged user.

Impact

Exploitation of this vulnerability could result in unauthorized execution of malicious CLI plugins, potentially leading to privilege escalation, especially if the user has elevated rights.