CVE-2020-26238: Critical vulnerability found in cron-utils
A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Cron-utils could allow a remote attacker to execute arbitrary code on the system, caused by a template Injection vulnerability. By sending a specially-crafted request, an attacker could exploit this vulnerability to inject arbitrary Java EL expressions and execute arbitrary code on the system.
— IBM
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-26238?
CVE-2020-26238 is considered a high severity vulnerability due to the potential for arbitrary code execution through unsanitized user input.
How do I fix CVE-2020-26238?
To fix CVE-2020-26238, ensure you are using an updated version of cron-utils that is above 9.1.3 that sanitizes user input properly.
Which software is affected by CVE-2020-26238?
CVE-2020-26238 affects cron-utils versions up to 9.1.3 and IBM products including Data Virtualization and Watson Query on specific versions.
What type of attack can CVE-2020-26238 facilitate?
CVE-2020-26238 can facilitate arbitrary code execution attacks using JavaEL through unvalidated user input.
Are there any known exploits for CVE-2020-26238?
As of now, there are no widely reported exploits for CVE-2020-26238, but the vulnerability's nature poses a significant risk.