OS Command Injection in Crontab-UI

Executive Summary

This is an OS command injection vulnerability in crontab-ui version 0.4.2 or earlier. An unauthenticated remote attacker can inject malicious cron job entries by sending a specially crafted GET request to the /crontab endpoint with URL-encoded newlines in the env_vars parameter. The application fails to sanitize newline characters, allowing the attacker to append arbitrary commands to the crontab file.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious cron job entries by running 'crontab -l' on the system hosting crontab-ui. Inspect network traffic for GET requests to /crontab with URL-encoded newlines in the env_vars parameter. Look for unauthorized cron expressions or commands in the crontab file.

Useful 0 Not Useful 0

Impact Analysis

An attacker could execute arbitrary commands on the server running crontab-ui with the privileges of the application. This could lead to full system compromise, data theft, or disruption of services. Since no authentication is required, any internet-facing instance is vulnerable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update crontab-ui to the latest version beyond 0.4.2. If updating is not possible, disable the application or restrict network access to it. Review and remove any unauthorized cron jobs. Monitor system logs for signs of exploitation.

Useful 0 Not Useful 0