CVE-2021-41269: Unauthenticated remote code injection in cron-utils
A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution (RCE) via Java Expression Language (EL) injection.
Other sources
A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability.
Upstream Advisory:
https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87
— Red Hat
cron-utils could allow a remote attacker to execute arbitrary code on the system, caused by a template Injection flaw . By sending a specially-crafted request to inject arbitrary Java EL expressions, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cron-utilsto a version that resolves this vulnerability.Fixed in 9.1.6 - Upgrade
Upgrade
cron-utilsto a version that resolves this vulnerability.Fixed in 9.1.6Patch GHSA-p9m8-27x8-rg87
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-41269?
CVE-2021-41269 is a vulnerability in the cron-utils Java library that allows an attacker to perform unauthenticated Remote Code Execution (RCE) by injecting arbitrary Java EL expressions.
What is cron-utils?
cron-utils is a Java library used for defining, parsing, validating, and migrating crons, as well as providing human-readable descriptions for them.
How severe is CVE-2021-41269?
CVE-2021-41269 has a severity rating of critical with a value of 9 on a scale of 1 to 10.
How can an attacker exploit CVE-2021-41269?
An attacker can exploit CVE-2021-41269 by injecting arbitrary Java EL expressions, which can lead to unauthenticated Remote Code Execution.
How can I fix CVE-2021-41269?
To fix CVE-2021-41269, update the cron-utils library to version 9.1.6, which includes the necessary remediation.