CVE-2017-20198
DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse
Severity Score
9.3
*CVSS v4
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.
*Credits:
Erik Daguerre
CVSS Scores
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
System
Vulnerable | Subsequent
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2025-07-22 CVE Reserved
- 2025-07-23 CVE Published
- 2025-07-23 CVE Updated
- 2025-07-23 First Exploit
- 2025-07-29 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
- CAPEC-137: Parameter Injection
- CAPEC-233: Privilege Escalation
References (5)
| URL | Tag | Source |
|---|---|---|
| https://web.archive.org/web/20230609134421/https://warroom.rsmus.com/dcos-marathon-compromise | Technical Description | |
| https://dcos.io | Product | |
| https://www.vulncheck.com/advisories/dcos-marathon-docker-mount-abuse-rce | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/42134 | 2025-07-23 | |
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dcos_marathon.rb | 2025-07-23 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| D2iQ, Inc. Search vendor "D2iQ, Inc." | DC/OS Marathon Search vendor "D2iQ, Inc." for product "DC/OS Marathon" | < 1.9.0 Search vendor "D2iQ, Inc." for product "DC/OS Marathon" and version " < 1.9.0" | en |
Affected
| ||||||