Description

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation. The hook field value is embedded directly into a shell command by crontab.js makeCommand() without sanitization, so a malicious hook value in the imported file results in command execution on the next cron execution cycle.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T11:17:32.003Z",
  "pubdate": "2026-08-10T11:17:32.003Z",
  "executiveSummary": "An OS command injection vulnerability exists in alseambusher/crontab-ui through version 0.4.2, allowing unauthenticated remote attackers to achieve arbitrary system command execution.\nThe flaw affects the POST /import endpoint, which accepts arbitrary .db files and overwrites the active application database without proper validation or sanitization.\nBy uploading a crafted crontab database file containing malicious input within the hook field, an attacker can trigger remote code execution when the underlying system processes the cron execution cycle.\nThis vulnerability presents a severe risk to confidentiality, integrity, and availability, effectively granting full system compromise to unauthenticated network-based attackers.\nSuccessful exploitation requires network access to the vulnerable endpoint and the ability to upload a specifically formatted database file containing malicious shell payloads.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and direct concatenation of untrusted data into a shell command within the application logic.\nThe vulnerable component is the POST /import endpoint in combination with the crontab.js makeCommand() function, which processes imported database files.\nThe affected versions include alseambusher/crontab-ui through 0.4.2, running over standard network protocols with unauthenticated remote exposure.\nAuthentication and privilege requirements are absent, meaning any remote attacker with network access to the endpoint can initiate the attack without credentials.\nThe attack flow begins when an unauthenticated attacker sends a malicious HTTP POST request to the /import endpoint, providing a crafted .db file containing a specially engineered payload.\nThe application accepts the arbitrary .db file and overwrites the existing database without verifying its contents or structure.\nDuring the parsing and execution phase, the makeCommand() function in crontab.js reads the hook field value from the imported database and embeds it directly into an operating system shell command without prior sanitization or escaping.\nWhen the cron execution cycle triggers the affected job, the unsanitized hook value is evaluated by the underlying shell interpreter, resulting in the execution of arbitrary system commands defined by the attacker.\nThe post-exploitation impact includes complete system compromise, arbitrary code execution with the privileges of the running application, potential lateral movement, and data exfiltration."
}