CVE-2021-41269: Template Injection leading to Remote Code Execution in cron-utils
Summary
CVE-2021-41269: Critical vulnerability found in cron-utils. Affects com.cronutils:cron-utils versions < 9.1.6. Fixed in 9.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cron-utils is a Java library that provides utilities for working with cron expressions. It includes features for parsing, validating, and manipulating cron expressions. The library is commonly used in Java projects that require cron expression handling. However, versions up to 9.1.2 of cron-utils are vulnerable to a critical Template Injection vulnerability.
Vulnerability Detail
The vulnerability in cron-utils allows attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE). This vulnerability can be exploited by attackers who can provide untrusted Cron expressions to projects using the @Cron annotation for validation. The vulnerability has a CVSS score of 10.0, indicating its critical severity. Only projects using the @Cron annotation are affected.
How To Fix
Minimum fixed version
9.1.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability at the moment. It is crucial to upgrade to the patched version to mitigate the risk of Remote Code Execution.
Conclusion
The Template Injection vulnerability in cron-utils can lead to unauthenticated Remote Code Execution. It is critical to upgrade to version 9.1.6 or later to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.cronutils:cron-utils →
FAQ
Versions up to 9.1.2 of cron-utils are vulnerable to this Template Injection vulnerability.
The vulnerability allows unauthenticated attackers to execute arbitrary code remotely, potentially leading to full compromise of the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your project's pom.xml file contains a vulnerable version of cron-utils.
There are no known public exploits for this vulnerability at the moment. However, it is crucial to upgrade to the patched version to prevent potential exploitation.
You can find a detailed description of the vulnerability in issue 461 of the cron-utils GitHub repository (https://github.com/jmrozanec/cron-utils/issues/461).
References
Related vulnerabilities
Recent vulnerabilities recorded for com.cronutils:cron-utils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
