CVE-2017-20198
CRITICALDC/OS Marathon < 1.9.0 - Docker Root Mount Code Execution
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2017-20198.
PoCs published by Metasploit, including Metasploit module exploits/linux/http/dcos_marathon.
AI-analyzed exploit summary This Metasploit module exploits a vulnerability in DC/OS Marathon UI to create a Docker container with host filesystem access, allowing arbitrary file creation/modification as root via a cron job. It leverages Docker volume mounting to achieve privilege escalation on the host system.
Description
The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.
Exploits (2)
This Metasploit module exploits a vulnerability in DC/OS Marathon UI to create a Docker container with host filesystem access, allowing arbitrary file creation/modification as root via a cron job. It leverages Docker volume mounting to achieve privilege escalation on the host system.
This Metasploit module exploits a vulnerability in DC/OS Marathon UI to create a Docker container with host filesystem access, allowing an attacker to write a cron job for persistent remote code execution. It leverages Docker volume mounting to gain root-level file system manipulation on the host.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N