CVE-2017-20198 DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse
CriticalCVSS 9.3
EPSS 1.3%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| d2iq DC/OS Marathon | < 1.9.0 | 1.9.0 |
References
- www.exploit-db.com exploit
- raw.githubusercontent.com exploit
- web.archive.org technical-description
- dcos.io product
- www.vulncheck.com third-party-advisory