Cronicleに権限昇格の脆弱性、0.9.124で修正
Summary
Cronicleで、管理者以外のユーザーがジョブの実行環境を書き換え、権限昇格や任意コード実行につなげられる脆弱性が公表されました。修正版が出ているので、版を確認して更新し、イベント権限を持つユーザーも見直してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Cronicleで、管理者以外のユーザーがジョブの実行環境を書き換え、権限昇格や任意コード実行につなげられる脆弱性が公表されました。修正版が出ているので、版を確認して更新し、イベント権限を持つユーザーも見直してください。
Original description The description as published by the source.
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.
Source: CVE.org (CVE Program・cvelistV5) NVD