Executive brief
Cronicle is a task scheduling and management tool used to automate server operations. A security flaw allows users with basic permissions to modify system-level task configurations that they should not be able to access. By running a specially crafted script, an attacker could redirect notifications to their own servers, potentially intercepting sensitive environment variables, internal network details, and script contents.
Technical details
A missing authorization check in the job output parser (lib/job.js) allows child processes to include an 'update_event' key in their JSON output. The server applies these updates directly to the parent event's stored configuration in the 'global/schedule' list without verifying the user's permissions. An attacker with 'create_events' or 'run_events' privileges can exploit this to overwrite event properties such as 'web_hook' or 'notify_success'. This can lead to the exfiltration of job objects—containing environment variables and internal IPs—to attacker-controlled endpoints. The issue is fixed in version 0.9.111 by restricting the allowed keys in job output.
Affected products
- jhuckaby Cronicle < 0.9.111
Timeline
- 2026-04-03: advisory: Vendor advisory published on GitHub
- 2026-04-07: disclosed: CVE published to NVD
- 2026-04-07: patched: Fix released in version 0.9.111