it's just too easy
Source: YouTube · John Hammond · published Sep 3, 2025 · 16:06
Docker Desktop CVE-2025-9074 allowed complete container escape on Windows and Mac through an unauthenticated API endpoint, letting attackers mount the host filesystem with just a simple web request from inside any container.
Key Takeaways:
• The vulnerability affected Docker Desktop versions before 4.44.3 on Windows and macOS, allowing containers to access the Docker API without authentication 0:37-0:51
• The exploit involved connecting to IP 192.168.65.7 on port 2375 to create a privileged container with the host's C drive mounted 1:24-1:42
• Just two HTTP POST requests to the Docker API were needed: one to create a container with host filesystem mounted, and another to start it 5:45-6:04
• The vulnerability could be exploited through SSRF (Server-Side Request Forgery) without requiring code execution within the container 6:55-7:04
• Linux systems were unaffected as they use a named pipe rather than a TCP socket for the Docker engine API 13:43-13:58
This vulnerability demonstrates how critical security gaps often stem from basic assumptions about network isolation and internal interfaces.
Sources:
- 0:37-0:51 Explanation of the vulnerability and affected versions
- 1:24-1:42 Technical details of the IP address and port used
- 5:45-6:04 The two POST requests needed for exploitation
- 6:55-7:04 SSRF exploitation details
- 13:43-13:58 Linux immunity explanation
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Docker. I barely know her. When SSRF is enough full Docker escape on Windows Docker Desktop CVE 20259074. This is a recent write up that I will leave a link in the video description. And I do want to give a big shout out. We'll hop over to his LinkedIn. Felix Boule. I'm so sorry. I don't know how to pronounce your last name. Felix. Sometimes bugs don't need to be that complicated. This is the tale of how I found the full Docker escape that was attributed CVE20259074. And that is now fixed. It is patched. So if you are running Docker for desktop on Windows or Mac OS, make sure you update upgrade get to version 4.44.3. Up until that version, an SSRF or like server side request forgery or a simple web request from any container was enough to fully compromise the host computer. Now you might t…