CVE-2023-5166: Docker Desktop Information Disclosure Flaw

CVE-2023-5166 Overview

CVE-2023-5166 is an Information Disclosure vulnerability affecting Docker Desktop versions prior to 4.23.0. The vulnerability allows attackers to steal Access Tokens through a crafted extension icon URL, potentially compromising user credentials and enabling unauthorized access to Docker resources.

Critical Impact

Access Token theft could allow attackers to gain unauthorized access to Docker Hub accounts, private registries, and container infrastructure managed through Docker Desktop.

Affected Products

• Docker Desktop versions before 4.23.0
• All platforms running vulnerable Docker Desktop versions (Windows, macOS, Linux)

Discovery Timeline

• 2023-09-25 - CVE-2023-5166 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-5166

Vulnerability Analysis

This vulnerability stems from improper handling of extension icon URLs within Docker Desktop's extension framework. When Docker Desktop processes extension metadata, it fails to properly validate and sanitize icon URLs, allowing malicious extensions to specify crafted URLs that can exfiltrate access tokens to attacker-controlled servers.

The vulnerability requires user interaction—specifically, the user must interact with or install a malicious extension. Once triggered, the extension's icon URL can be crafted to include authentication tokens as URL parameters, effectively leaking sensitive credentials to external endpoints.

Root Cause

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Docker Desktop's extension system did not implement adequate input validation on icon URLs, nor did it ensure that access tokens were excluded from requests to external resources. This oversight allowed extension developers (or attackers posing as such) to craft icon URLs that would cause Docker Desktop to inadvertently transmit access tokens when fetching extension icons.

Attack Vector

The attack is network-based and exploits the trust relationship between Docker Desktop and its extension ecosystem. An attacker would need to:

1. Create a malicious Docker Desktop extension with a specially crafted icon URL
2. Distribute the extension through social engineering or by publishing it where users might discover it
3. When a user installs or views the extension, Docker Desktop fetches the icon from the malicious URL
4. The crafted URL captures the user's access token in the request, sending it to an attacker-controlled server

The vulnerability does not require elevated privileges but does require user interaction to trigger the token exfiltration.

Detection Methods for CVE-2023-5166

Indicators of Compromise

• Unusual outbound network connections from Docker Desktop to unknown or suspicious domains
• Extension icon URLs containing query parameters or unusual path structures
• Access token usage from unexpected IP addresses or geographic locations
• Unexpected Docker Hub or registry API calls using stolen credentials

Detection Strategies

• Monitor Docker Desktop extension installations and review installed extensions for unknown or untrusted sources
• Implement network traffic analysis to detect token exfiltration attempts through URL parameters
• Audit Docker Hub and private registry access logs for unauthorized authentications
• Review installed extension metadata for suspicious icon URL patterns

Monitoring Recommendations

• Enable logging for Docker Desktop extension activities and network connections
• Configure SIEM alerts for anomalous Docker-related network traffic patterns
• Implement endpoint detection rules to identify Docker Desktop communicating with unknown external domains
• Monitor for signs of credential misuse across your Docker infrastructure

How to Mitigate CVE-2023-5166

Immediate Actions Required

• Upgrade Docker Desktop to version 4.23.0 or later immediately
• Review currently installed Docker Desktop extensions and remove any untrusted or unknown extensions
• Rotate Docker Hub and registry access tokens as a precautionary measure
• Audit Docker Hub account activity for any suspicious access patterns

Patch Information

Docker has addressed this vulnerability in Docker Desktop version 4.23.0. The fix implements proper validation of extension icon URLs and prevents access tokens from being leaked through crafted URLs. Users should upgrade to the patched version as soon as possible. For detailed release information, see the Docker Desktop Release Notes.

Workarounds

• Avoid installing Docker Desktop extensions from untrusted or unverified sources until the patch is applied
• Consider temporarily disabling Docker Desktop extensions if immediate upgrade is not possible
• Implement network-level controls to restrict Docker Desktop's outbound connections to known, trusted domains
• Use network monitoring tools to detect and block suspicious outbound token exfiltration attempts

# Verify Docker Desktop version and upgrade
docker --version
# If below 4.23.0, download the latest version from https://www.docker.com/products/docker-desktop/

# List installed extensions (requires Docker Desktop CLI)
docker extension ls

# Remove suspicious extensions
docker extension rm [extension-name]