CVE-2021-41269 Unauthenticated remote code injection in cron-utils

What is CVE-2021-41269?

CVE-2021-41269 is a critical code injection vulnerability in jmrozanec cron-utils, published on 15 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.

Weakness: CWE-94

Which versions are affected by CVE-2021-41269?

2 open source packages ship an affected version, including com.cronutils:cron-utils. It affects 1 product.

Products include Cron-Utils Project Cron-Utils.

How do I fix CVE-2021-41269?

Upgrade com.cronutils:cron-utils to 9.1.6 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-41269 being exploited?

There is no known exploitation of CVE-2021-41269 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in jmrozanec cron-utils

• CVE-2020-26238 Critical vulnerability found in cron-utils High 7.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p9m8-27x8-rg87.