Description

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter. The handler appends the env_vars value directly to the crontab file string as '${envVars}\n' without stripping newline characters, enabling an attacker to insert arbitrary cron expressions that execute attacker-controlled commands.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T11:17:32.123Z",
  "pubdate": "2026-08-10T11:17:32.123Z",
  "executiveSummary": "An OS command injection vulnerability exists in alseambusher/crontab-ui through version 0.4.2, arising from improper handling of user-supplied input within the environment variables parameter. This security flaw allows unauthenticated remote attackers to manipulate the underlying system crontab file by transmitting a specifically crafted HTTP GET request containing URL-encoded newlines to the /crontab endpoint. The resultant impact includes arbitrary cron job creation and remote command execution, presenting a severe risk to host integrity and confidentiality. The vulnerability requires network access to the target application interface but bypasses authentication mechanisms entirely, enabling unauthorized external actors to execute arbitrary system commands under the privileges of the application process. Remediation requires strict input validation and sanitization of newline characters within environment variables before file concatenation.",
  "technicalDetails": "The vulnerability resides in the request handler responsible for processing environment variables within the alseambusher/crontab-ui application up to version 0.4.2. Specifically, when the application receives an HTTP GET request directed to the /crontab endpoint, it extracts the env_vars parameter supplied by the client. The core root cause of the flaw is the direct, unvalidated string concatenation of the env_vars value into the internal crontab file string representation using the template format '${envVars}\\n'. The application fails to strip or sanitize carriage return and newline characters (such as %0A or \\n) from the input before appending it to the file structure.\nTo exploit this OS command injection vulnerability, an unauthenticated remote attacker crafts an HTTP GET request targeting the vulnerable /crontab route. Within the payload, the attacker injects URL-encoded newline characters followed by malicious cron job syntax into the env_vars parameter. Because the application blindly trusts and appends the raw parameter value, the injected newline breaks out of the intended environment variable definition context and introduces new, attacker-controlled lines directly into the crontab file.\nWhen the operating system or the cron daemon subsequently parses the modified crontab file, the injected cron expressions are executed at scheduled intervals. This attack flow effectively translates an HTTP request into persistent, arbitrary OS command execution with the execution privileges of the crontab-ui service user. The attack vector is strictly network-based, requires no prior authentication or administrative privileges, and successfully compromises the underlying host system via logic flaws in parameter processing."
}