A critical CRLF injection vulnerability in alseambusher crontab-ui allows unauthenticated remote attackers to inject and execute arbitrary cron jobs on the host system.

The application fails to properly neutralize CRLF sequences within the env_vars parameter, allowing an unauthenticated attacker to manipulate cron job files. This results in the ability to inject arbitrary commands that will be executed by the cron daemon.

With a CVSS score of 9.8, this vulnerability poses a severe risk to the integrity and availability of the host server. An attacker can leverage this access to establish persistence, disrupt scheduled tasks, or execute arbitrary payloads with the privileges of the service user, potentially leading to total system compromise.

Immediate Action: Update alseambusher crontab-ui to the latest version that effectively filters CRLF sequences from input parameters.

Proactive Monitoring: Review crontab configurations for unexpected entries and monitor application logs for suspicious GET requests containing newline characters.

Compensating Controls: Use a Web Application Firewall to block requests containing CRLF sequences or other suspicious patterns directed at the /crontab endpoint.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk due to its potential for persistent code execution. Administrators must apply the latest security updates immediately to ensure that input validation is correctly enforced and to prevent unauthorized cron job manipulation.