it only took 2 lines of code...

Quick Overview

A critical Docker Desktop vulnerability (CVE-2025-9074) allowed full container escape on Windows by exploiting an unauthenticated API endpoint, enabling attackers to gain access to the host system's C: drive and execute arbitrary code.

Key Points: A Server-Side Request Forgery (SSRF) vulnerability in Docker Desktop for Windows (CVE-2025-9074) allowed a full container escape. The vulnerability existed in unpatched versions of Docker Desktop, specifically those attributed to the "4.44.3" patch. An attacker could exploit this by sending an unauthenticated API request from a container to a specific IP address and port. This exploit allowed mounting the host's C: drive into the container, granting full access to the Windows host. The vulnerability was discovered by Philippe Dugre and was replicated on macOS. Docker has since fixed the vulnerability in version 4.44.3. The exploit requires the container to have network access to the Docker API endpoint.

Context: The video discusses a critical vulnerability found in Docker Desktop for Windows, identified as CVE-2025-9074. This vulnerability, discovered by Philippe Dugre, allowed for a full container escape, meaning an attacker could break out of the containerized environment and gain access to the underlying host system. The exploit leveraged an unauthenticated API endpoint, which was a significant oversight in the software's security design.

Detailed Analysis

The video explains a critical container escape vulnerability (CVE-2025-9074) in Docker Desktop for Windows. This flaw allowed unauthenticated API requests from a container to access the host's C: drive, enabling attackers to execute arbitrary code and gain full control over the Windows host system. The vulnerability was discovered accidentally by security researcher Philippe Dugre, who found that unpatched versions of Docker Desktop could be exploited by simply making a request to the Docker API. This was possible because the container was not properly isolated from the host's file system and API endpoints. The exploit involves creating a container, mounting the host's C: drive, and then executing commands within that container to write or read files on the host. The vulnerability was confirmed to be present on both Windows and macOS versions of Docker Desktop. The presenter emphasizes that this is a critical issue, as it bypasses the intended isolation mechanisms of containers, allowing for potential system compromise. The fix for this vulnerability was released in version 4.44.3 of Docker Desktop.