Cron Job Security: Common Vulnerabilities and Fixes

Cron jobs are the most popular and frequently chosen tool for automating tasks on servers.

However, if improperly configured or lacking security, they can expose sensitive data, execute arbitrary commands, and even allow attackers to gain full system access.

In this article, I will discuss common cron job security vulnerabilities, practical solutions, and a checklist to help you ensure the security of your cron jobs.

--

Running cron jobs as root

Running cron jobs as root is convenient, but dangerous. If the script becomes infected, an attacker can gain full system privileges.

Solution:

• Create a dedicated system user (e.g., cron-app)
• Follow the principle of least privilege

useradd cron-app
crontab -u cron-app -e

Writable Scripts and Directories

If scripts or directories are writable by other users, attackers can modify them.

Solution:

chmod 750 backup.sh
chown cron-app:cron-app backup.sh
chmod 750 /var/scripts

Executing User-Controlled Commands

Try to prevent user input, APIs, etc., whenever possible. If necessary, always validate such data to avoid injecting unwanted commands.

Example of a vulnerable script:

#!/bin/bash

FILENAME="$1"
rm /tmp/$FILENAME

Cron:

* * * * * /var/scripts/cleanup.sh "$FILENAME_FROM_DB"

Solution:

#!/bin/bash

FILENAME="$1"

# only letters, numbers, dots and dashes
if [[ ! "$FILENAME" =~ ^[a-zA-Z0-9._-]+$ ]]; then
  echo "Invalid filename" >&2
  exit 1
fi

rm -- "/tmp/$FILENAME"

Storing passwords or other secrets directly in the script.

Placing API keys or passwords directly in crontab files is very risky and should not be done.

Vulnerable to attacks:

* * * * * php script.php --mysql_password=%456665ffgg43554##$DG$%GFEdd3

Solution

Store all confidential and sensitive data in shell environment variables or .env files, and restrict .env file permissions.

chmod 600 .env

It's also worth considering using dedicated managers, such as Vault or AWS SSM.

No Logging or Monitoring

"Silent" cron jobs hide failures and attacks.

Solution

>> /var/log/cron/app.log 2>&1

World-Readable Crontab

Check if crontab is exposed:

ls -la /var/spool/cron/

Solution

chmod 600 /var/spool/cron/cron-app