CVE-2020-26238 Critical vulnerability found in cron-utils
Attackers can achieve remote code execution by injecting Java EL expressions into untrusted Cron expressions validated via the @Cron annotation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26238?
CVE-2020-26238 is a high-severity code injection vulnerability in jmrozanec cron-utils, published on 24 Nov 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
Weakness: CWE-74
Which versions are affected by CVE-2020-26238?
2 open source packages ship an affected version, including com.cronutils:cron-utils. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.cronutils:cron-utils Maven | All versions | 9.1.3 |
com.cronutils:cron-utils Maven | All versions | 9.1.3 |
Products include Cron-Utils Project Cron-Utils.
How do I fix CVE-2020-26238?
Upgrade com.cronutils:cron-utils to 9.1.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-26238 being exploited?
There is no known exploitation of CVE-2020-26238 in the wild and no public exploit code.
Other vulnerabilities in jmrozanec cron-utils
Sources
Also known as GHSA-pfj3-56hm-jwq5.