> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/installed-to-be-wild-privesc-paths-in-windows-apps/docker.md).

# Docker

| Docker version | CVE                                                                                                                                            | Notes                                                                                                 |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| `< 2.1.0.1`    | [CVE-2019-15752](/breakpoint/windows/windows-privilege-escalation/installed-to-be-wild-privesc-paths-in-windows-apps/docker.md#cve-2019-15752) | Docker Desktop Community Edition privilege escalation path via writable `version-bin` lookup location |

## CVE-2019-15752

Docker Desktop Community Edition versions earlier than `2.1.0.1` checked for helper files such as `docker-credential-wincred.exe` and `docker-credential-wincred.bat` during startup. Those files were not part of a normal installation, but Docker still searched for them in `C:\PROGRAMDATA\DockerDesktop\version-bin\`.

That directory was writable by `BUILTIN\Users`. Any authenticated user could therefore place a malicious executable there. The payload would run when Docker launched or when a user ran `docker login`.

This issue is older, but it can still matter on neglected developer workstations. It does not guarantee immediate elevation because it depends on a restart or user action. It still creates a useful persistence and escalation path when the version is vulnerable.

### Reference

* [Elevation of Privilege in Docker for Windows](https://medium.com/@morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478e)