CVE-2017-20198

CVE-2017-20198 is a critical vulnerability affecting DC/OS versions prior to 1.9.0, allowing unauthenticated attackers to deploy arbitrary Docker containers through the Marathon UI. By improperly configuring volume mounts, an attacker can mount the host's root filesystem with read/write privileges. This enables arbitrary code execution with root privileges by writing to /etc/cron.d/ using a malicious Docker image. The vulnerability has a CVSS score of 9.3 (CRITICAL) due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. While not on the KEV catalog, a Metasploit module exists, and it has significant community discussion, indicating potential for exploitation.