CVE-2025-9074 (Educational PoC / Proof of Concept Code)

This repository contains a PoC for educational purposes that demonstrates the risk of exploiting Docker Engine's unauthenticated remote API to create a privileged container with read/write access to the host filesystem. The executable file is poc.go.

Important: This PoC is for educational and defensive purposes only. Do not execute in third-party environments or on unauthorized systems.

Risk Assessment

Overall Rating: Critical
Estimated CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Rationale:
- Reachable on TCP/2375 without authentication → PR:N, UI:N, AV:N
- Privileged container + host bind mount results in scope change and high impact on confidentiality/integrity/availability → S:C, C/I/A:H
- Attack steps are completed with a few HTTP requests to the Docker Engine API → AC:L
Scope of Impact:
- Entire host OS, other containers, and assets on the same network (including credential theft and lateral movement)
Required Privileges:
- Unauthenticated (PR:N). No administrator privileges required.

Background

Docker Engine provides a remote API that can be operated via endpoints such as /version, /info, and /containers/create.
If the container is accessible from outside, there are cases where operations such as creating containers, granting privileges, and bind-mounting host directories are possible without authentication.
In Windows + Docker Desktop environments, there are mount paths that allow access to Windows host drives via /run/desktop/mnt/host/<drive> or /host_mnt/<drive>. This PoC uses these paths to visualize the impact by creating files on the host.

Operation Overview

poc.go performs the following:

Calls the Docker Engine API at http://192.168.65.7:2375 to check connectivity (/version)
Checks the list of available images (/images/json), and if none, attempts to pull alpine:latest
Creates a privileged container and bind-mounts host drives (e.g., C:, N:) to /host_root
Writes a verification file (e.g., cve_2025_9074_poc.txt) directly under /host_root from within the container to visualize the impact
Deletes the container after execution

Risks (Potential Misuse)

Read/write to host filesystem (within Docker Engine execution privileges)
Theft of sensitive information (passwords, SSH keys, etc.)
Tampering with system configuration files
Malware installation and persistence
Lateral movement to other containers and networks
Privilege escalation

Requirements

Go 1.20+ (works with go run)
(Vulnerable) Docker Desktop/Engine running
Execute this code within a Docker container running on (vulnerable) Docker Desktop/Engine
Docker Engine API responding at http://192.168.65.7:2375 (PoC default)

Usage

Clone the repository
```
git clone <this-repo>
cd cve-2025-9074
```
Run the PoC
```
go run poc.go
```
Example output
- Displays success of connectivity to /version
- Detection of available images or pull of alpine:latest
- Privileged container creation, result of file creation on host
- Excerpt of system information based on /info
Example curl for demonstration (displayed on screen)
- JSON example for /containers/create, startup example for /containers/{id}/start

Customization

The candidate array in attemptHostWrite (e.g., /run/desktop/mnt/host/<drive>, /host_mnt/<drive>, C:/, etc.) can be adjusted according to the environment.
Image to use
- Priority to existing images; if none, automatically pull alpine:latest.

Notes on Verification Environment

Includes mount path examples based on behavior in Windows + Docker Desktop.
For macOS, host paths differ so modification is necessary.
Depending on Docker Desktop version and settings, the PoC may not work (i.e., it is safe).

Disclaimer

This repository is intended solely for research and educational purposes. It does not promote attacks, intrusions, or destructive acts.
The author is not responsible for any damages arising from the use of this PoC.
Do not execute outside an isolated environment where you have legitimate administrative authority.

License