CVE-2024-9348 Overview
CVE-2024-9348 is a remote code execution (RCE) vulnerability affecting Docker Desktop versions prior to v4.34.3. The flaw resides in the Build view, where the application fails to sanitize GitHub source links before processing them. An attacker who convinces a user to interact with a malicious GitHub source link can trigger code execution on the host running Docker Desktop. The issue is tracked under [CWE-20] Improper Input Validation and [CWE-116] Improper Encoding or Escaping of Output.
Critical Impact
Successful exploitation allows attackers to execute arbitrary code on developer workstations running vulnerable Docker Desktop builds, enabling lateral movement into container build pipelines and source repositories.
Affected Products
- Docker Desktop versions prior to v4.34.3
- Docker Desktop Build view component
- Workstations running vulnerable Docker Desktop installations on Windows, macOS, and Linux
Discovery Timeline
- 2024-10-16 - CVE-2024-9348 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9348
Vulnerability Analysis
The vulnerability stems from how Docker Desktop's Build view processes GitHub source links supplied by users. The application accepts these links without sanitization or output encoding. When the link is rendered or executed in the Build workflow, attacker-controlled content is interpreted as commands or executable references rather than inert data.
This input validation failure ([CWE-20]) combined with improper encoding of output ([CWE-116]) produces a path to arbitrary code execution on the host. The attacker does not require credentials on the target system. However, the attack requires user interaction, such as clicking a crafted link or opening a malicious repository reference, which raises attack complexity.
The EPSS score is 0.475% at the 37.5th percentile, indicating limited observed exploitation activity at this time.
Root Cause
The Build view component accepts GitHub source URLs as user input and passes them downstream without enforcing strict allowlists, escaping shell metacharacters, or encoding HTML or command contexts. The trust boundary between externally supplied repository references and the local execution context is not enforced.
Attack Vector
An attacker hosts a malicious payload referenced through a crafted GitHub source link. The attacker delivers this link through phishing, public repositories, README files, or chat channels. When the developer enters the link into the Docker Desktop Build view, the unsanitized input is processed and the embedded payload executes in the context of the local user. The result is RCE on the developer workstation, with the attacker gaining the same privileges as the Docker Desktop user.
No verified public proof-of-concept exploit code is available. Refer to the Docker Desktop Release Notes for vendor-published technical details.
Detection Methods for CVE-2024-9348
Indicators of Compromise
- Unexpected child processes spawned by Docker Desktop binaries such as Docker Desktop.exe or com.docker.backend
- Outbound network connections from Docker Desktop processes to non-GitHub or unfamiliar domains shortly after a Build view interaction
- New scheduled tasks, LaunchAgents, or cron entries created by the Docker Desktop user session following a build operation
- Build logs referencing GitHub URLs containing shell metacharacters, URL-encoded payloads, or suspicious query parameters
Detection Strategies
- Inventory all endpoints running Docker Desktop and flag versions earlier than v4.34.3
- Hunt for process trees where Docker Desktop spawns shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash) without legitimate build context
- Correlate Build view activity timestamps with file creation, persistence mechanism changes, and outbound connections
- Inspect command-line arguments for encoded payloads associated with GitHub source link inputs
Monitoring Recommendations
- Forward endpoint telemetry, including process creation and network connection events, to a centralized analytics platform
- Alert on Docker Desktop child processes that execute scripting interpreters or download utilities such as curl, wget, or Invoke-WebRequest
- Monitor developer workstations for unauthorized modifications to Docker configuration files and credential stores
- Track outbound traffic from Docker Desktop hosts to repository services and flag connections to newly registered domains
How to Mitigate CVE-2024-9348
Immediate Actions Required
- Upgrade Docker Desktop to v4.34.3 or later on all affected workstations
- Audit recent Build view activity for interactions with untrusted GitHub source links
- Reset credentials and tokens stored on workstations suspected of compromise, including GitHub personal access tokens and registry credentials
- Restrict developer workstations from executing builds against unverified external repositories
Patch Information
Docker addressed CVE-2024-9348 in Docker Desktop v4.34.3. The fix introduces sanitization and validation of GitHub source links accepted by the Build view. Patch details are documented in the Docker Desktop Release Notes.
Workarounds
- Avoid pasting or opening untrusted GitHub source links inside the Docker Desktop Build view until patching completes
- Enforce organizational policy that restricts builds to repositories on an internal allowlist
- Apply least-privilege principles to developer accounts to reduce the impact of code executing in the user context
- Segment developer networks so that compromised workstations cannot reach sensitive build infrastructure or production registries
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
