Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-26238

CVE-2020-26238: Template injection in cron-utils

7.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-26238
GHSA ID
GHSA-pfj3-56hm-jwq5
EPSS Score
0.91637%
CWE
CWE-74
Published
11/24/2020
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.cronutils:cron-utilsmaven< 9.1.39.1.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from using Hibernate Validator (v5.3.6.Final) for @Cron annotation validation, which processes Java EL expressions. The commit 4cf373f replaced Hibernate with BVal specifically to avoid EL evaluation. The vulnerable function would be the validator() implementation handling cron expression validation before this change, as it didn't sanitize EL expressions in user-provided cron patterns.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * T*mpl*t* Inj**tion w*s i**nti*i** in *ron-utils *n**lin* *tt**k*rs to inj**t *r*itr*ry J*v* *L *xpr*ssions, l***in* to un*ut**nti**t** R*mot* *o** *x**ution (R**) vuln*r**ility. V*rsions up to *.*.* *r* sus**pti*l* to t*is vuln*r**ility.

Reasoning

T** vuln*r**ility st*ms *rom usin* `*i**rn*t* V*li**tor` (v*.*.*.*in*l) *or @*ron *nnot*tion v*li**tion, w*i** pro**ss*s J*v* *L *xpr*ssions. T** *ommit ******* r*pl**** `*i**rn*t*` wit* `*V*l` sp**i*i**lly to *voi* *L *v*lu*tion. T** vuln*r**l* `*un