PT-2021-4860 · Unknown · Cron-Utils

Niels + 1 · Published 2021-10-29 · Updated 2021-11-19 · CVE-2021-41269

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cron-utils versions up to 9.1.2

Description A template injection issue was identified in cron-utils, enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE). This issue affects projects using the @Cron annotation to validate untrusted Cron expressions.

Recommendations For versions up to 9.1.2, please upgrade to version 9.1.6 to resolve the issue. As a temporary workaround, consider avoiding the use of the @Cron annotation to validate untrusted Cron expressions until the patch is applied. There are no known workarounds other than upgrading to the patched version.

Exploit

Fix

Code Injection

SQL injection

Weakness Enumeration

CWE-94

CWE-89

Related Identifiers

BDU:2021-05588

BDU:2021-05647

CVE-2021-41269

GHSA-P9M8-27X8-RG87

Affected Products

Cron-Utils

References · 15

• 🔥 https://github.com/jmrozanec/cron-utils/issues/461 · Exploit
• https://github.com/jmrozanec/cron-utils/commit/d6707503ec2f20947f79e38f861dba93b39df9da · Patch
• https://github.com/jmrozanec/cron-utils/commit/cfd2880f80e62ea74b92fa83474c2aabdb9899da · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41269 · Security Note
• https://osv.dev/vulnerability/GHSA-p9m8-27x8-rg87 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05588 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31849 · Security Note
• https://bdu.fstec.ru/vul/2021-05647 · Security Note
• https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87 · Note
• https://github.com/jmrozanec/cron-utils · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10371 · Note
• https://t.me/cvenotify/23488 · Telegram Post
• https://access.redhat.com/security/cve/cve-2021-41269 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10371 · Note