Crontab Ui
Monthly
Cron/OS command injection in alseambusher's crontab-ui (through 0.4.2) lets a remote attacker who can reach the web interface inject arbitrary cron entries via a crafted GET request to /crontab, where the env_vars parameter is written into the crontab file without stripping newlines. Because scheduled cron jobs execute shell commands, successful injection yields arbitrary command execution as the account running the cron daemon/crontab-ui service. CVSS is rated 9.8 (network, low complexity, no privileges per the supplied vector); no public exploit and no CISA KEV entry are indicated at time of analysis, though the technique is simple to reproduce.
OS command injection in alseambusher/crontab-ui through 0.4.2 lets a remote, unauthenticated attacker POST a crafted crontab database to the /import endpoint, which silently overwrites the application's job database; a malicious 'hook' value is then concatenated into a shell command by makeCommand() and runs on the next cron cycle. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects trivial, pre-authentication reachability with full confidentiality, integrity, and availability impact on the host. Any internet- or LAN-exposed crontab-ui instance without an external access-control layer should be treated as high priority.
Cron/OS command injection in alseambusher's crontab-ui (through 0.4.2) lets a remote attacker who can reach the web interface inject arbitrary cron entries via a crafted GET request to /crontab, where the env_vars parameter is written into the crontab file without stripping newlines. Because scheduled cron jobs execute shell commands, successful injection yields arbitrary command execution as the account running the cron daemon/crontab-ui service. CVSS is rated 9.8 (network, low complexity, no privileges per the supplied vector); no public exploit and no CISA KEV entry are indicated at time of analysis, though the technique is simple to reproduce.
OS command injection in alseambusher/crontab-ui through 0.4.2 lets a remote, unauthenticated attacker POST a crafted crontab database to the /import endpoint, which silently overwrites the application's job database; a malicious 'hook' value is then concatenated into a shell command by makeCommand() and runs on the next cron cycle. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects trivial, pre-authentication reachability with full confidentiality, integrity, and availability impact on the host. Any internet- or LAN-exposed crontab-ui instance without an external access-control layer should be treated as high priority.