CVE-2017-20198
DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse
Published 15 mo ago · modified 4 mo ago · JSON
Summary
The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 15 mo ago
Exploit prediction (EPSS)
1.31% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- D2iQ, Inc. DC/OS Marathon
Classification
- Weakness
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
- exploit-db.com /exploits/42134 · exploit
- raw.githubusercontent.com /rapid7/metasploit-framework/master/modules/exploits/linux/http/dcos_marathon.rb · exploit
- web.archive.org /web/20230609134421/https://warroom.rsmus.com/dcos-marathon-compromise/ · technical-description
- dcos.io / · product
- vulncheck.com /advisories/dcos-marathon-docker-mount-abuse-rce · third-party-advisory
Sources
- CVE List: CVE-2017-20198
- NVD: CVE-2017-20198
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.