PT-2020-16366 · Unknown · Cron-Utils

Published 2020-11-24 · Updated 2021-03-24 · CVE-2020-26238

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions cron-utils versions prior to 9.1.3

Description A template injection vulnerability is present in cron-utils, enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This issue affects only projects using the @Cron annotation to validate untrusted Cron expressions.

Recommendations For versions prior to 9.1.3, upgrade to version 9.1.3 to resolve the issue. As a temporary workaround, consider avoiding the use of the @Cron annotation to validate untrusted Cron expressions until the patch is applied.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-26238

GHSA-PFJ3-56HM-JWQ5

Affected Products

Cron-Utils

References · 29

• 🔥 https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-pfj3-56hm-jwq5 · Exploit
• 🔥 https://github.com/jmrozanec/cron-utils/issues/461 · Exploit
• https://github.com/jmrozanec/cron-utils/commit/4cf373f7352f5d95f0bf6512af8af326b31c835e · Patch
• https://osv.dev/vulnerability/GHSA-pfj3-56hm-jwq5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26238 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26238 · Vendor Advisory
• https://lists.apache.org/thread.html/r50e1b5544c37e408ed7e9a958b28237b1cb9660ba2b3dba46f343e23%40%3Cissues.hive.apache.org%3E · Note
• https://lists.apache.org/thread.html/r855aead591697dc2e85faf66c99036e49f492431940b78d4e6d895b5@%3Cgitbox.hive.apache.org%3E · Note
• https://lists.apache.org/thread.html/r432a69a1a85cbcb1f1bad2aa0fbfce0367bf894bf917f6ed7118e7f0@%3Cissues.hive.apache.org%3E · Note
• https://lists.apache.org/thread.html/r71083c759dc627f198571b3d48b6745fe798b1d53c34f7ef8de9e7dd%40%3Cissues.hive.apache.org%3E · Note
• https://lists.apache.org/thread.html/r71083c759dc627f198571b3d48b6745fe798b1d53c34f7ef8de9e7dd@%3Cissues.hive.apache.org%3E · Note
• https://t.me/cvenotify/6167 · Telegram Post
• https://t.me/cvenotify/11831 · Telegram Post
• https://lists.apache.org/thread.html/r96937fc9c82f3201b59311c067e97bce71123944f93102169a95bf5c@%3Cissues.hive.apache.org%3E · Note
• https://lists.apache.org/thread.html/r737406bc17d49ffe8fe6a8828d390ee0a02e45e5a5b4f931180b9a93%40%3Cissues.hive.apache.org%3E · Note