Github.com — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/github.com/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 04 May 2026 21:24:50 +0000Pelican Web UI Privilege Escalation Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-05-pelican-privesc/Mon, 04 May 2026 21:24:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-pelican-privesc/A privilege escalation vulnerability in Pelican WebUI versions v7.21 to v7.24 allows authenticated users to gain admin privileges by manipulating database records, potentially leading to configuration modification, API token creation, and password changes.On April 2nd, 2026, a privilege escalation vulnerability was identified in the Pelican Web User Interface (WebUI) affecting versions v7.21 to v7.24. This vulnerability allows any authenticated user via OAuth to gain admin privileges under specific configurations, including servers with Server.UIAdminUsers where listed users haven’t logged in or Server.AdminGroups with Issuer.GroupSource set to internal where an admin hasn’t logged in. Successful exploitation permits attackers to modify server configurations, create API tokens, and change admin passwords. The OSDF operations team mitigated this vulnerability for core services, but mitigation may be required for other caches and origins. There is currently no evidence this attack has been exploited in services managed by OSDF operators.

Attack Chain

  1. An attacker gains initial access to the Pelican WebUI by authenticating via OIDC.
  2. The attacker identifies a valid Server.UIAdminUsers username or Server.AdminGroups group name for an admin who has not yet logged into the WebUI.
  3. The attacker crafts malicious database records designed to grant admin privileges upon subsequent login.
  4. The attacker injects these records into the Pelican server’s SQLite database, potentially using API endpoints or other methods to interact with the database.
  5. The attacker logs out of the WebUI.
  6. The attacker logs back into the WebUI.
  7. The server grants the attacker admin privileges based on the manipulated database records.
  8. The attacker modifies server configurations, creates persistent API tokens, or changes admin passwords.

Impact

The successful exploitation of this vulnerability poses a significant risk to Pelican servers and the wider federation they support. A compromised Director service could have high federation-wide impact, enabling denial of service and redirection to malicious registries. Registry services also have high federation-wide impact, with attackers potentially poisoning namespaces. Compromised Origins could lead to high data exposure and tampering risks by enabling unauthorized writes and changing export paths. Caches present a medium data exposure risk, as attackers could expose cached protected data.

Recommendation

  • Run the provided mitigation script (mitigate-user-escalation.sh from https://gist.github.com/jhiemstrawisc/8c4b2b3ec5cb2ca06537d9439dc16cc9) to audit the database for signs of exploitation and block further exploitation.
  • Upgrade Pelican servers to a patched release (>=v7.21.5, >=v7.22.3, >=v7.23.3, >=v7.24.2).
  • If unable to upgrade immediately, disable the vulnerable configuration by commenting out UIAdminUsers and AdminGroups settings in the pelican.yaml configuration file.
  • Monitor process executions for the mitigate-user-escalation.sh script and review associated user and API token changes. Deploy the provided Sigma rule to detect potential malicious activity.
]]>criticaladvisoryprivilege-escalationwebuipelicanMini Shai-Hulud Supply Chain Attack Targets SAP NPM Packageshttps://feed.craftedsignal.io/briefs/2026-04-mini-shai-hulud/Thu, 30 Apr 2026 14:27:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-04-mini-shai-hulud/The Mini Shai-Hulud campaign injected malicious code into SAP NPM packages, targeting credentials and cloud secrets related to SAP Cloud Application Programming (CAP) and SAP cloud deployment workflows, exfiltrating data through public GitHub repositories.The Mini Shai-Hulud campaign, active as of April 2026, targets SAP NPM packages used in the SAP Cloud Application Programming (CAP) ecosystem and SAP cloud deployment workflows. Four package versions were compromised: mbt 1.2.48, @cap-js/db-service 2.10.1, @cap-js/postgres 2.2.2, and @cap-js/sqlite 2.2.2. These packages, with over 500,000 combined weekly downloads, are essential for SAP’s Cloud MTA Build Tool and database services for CAP software. The attackers injected a preinstall script that fetches and executes a Bun binary, bypassing security monitoring. The malicious versions were available for a short window of 2-4 hours before being unpublished and superseded by clean versions. Wiz attributes this activity to TeamPCP due to a shared RSA public key used to encrypt the exfiltrated secrets.

Attack Chain

  1. The attacker compromises an NPM token, possibly exposed through CircleCI.
  2. The attacker injects a malicious preinstall script into the targeted SAP NPM packages (mbt, @cap-js/db-service, @cap-js/postgres, @cap-js/sqlite).
  3. When a user installs the compromised package, the preinstall script executes.
  4. The script fetches a Bun ZIP archive from a GitHub repository.
  5. The script extracts the Bun archive and executes the included Bun binary.
  6. The Bun binary steals local credentials, GitHub and NPM tokens, AWS, Azure, GCP, GitHub Action, and Kubernetes secrets.
  7. The stolen data is exfiltrated to public GitHub repositories with the description “A Mini Shai-Hulud has Appeared”.
  8. The malware propagates by modifying package tarballs, updating versions, repackaging them, and publishing them using stolen GitHub Actions tokens.

Impact

The Mini Shai-Hulud attack poses a significant threat to developers and organizations using SAP CAP, a framework for S/4HANA extensions, Fiori app backends, MTAs, and integration flows. With over 500,000 weekly downloads of the affected packages, a large number of systems could have been affected. Successful exploitation allows attackers to steal sensitive credentials and cloud secrets, potentially leading to unauthorized access to critical SAP systems, cloud infrastructure, and source code repositories. This access could be used for further malicious activities, including data breaches, financial fraud, and supply chain compromise.

Recommendation

  • Organizations using SAP Business Technology Platform workflows, SAP CAP, or MTA-based deployment pipelines should immediately check if they installed the malicious package versions (mbt 1.2.48, @cap-js/db-service 2.10.1, @cap-js/postgres 2.2.2, @cap-js/sqlite 2.2.2) during the exposure window.
  • Implement network monitoring rules to detect connections to unusual GitHub repositories created to host stolen data. Monitor for repositories with the description “A Mini Shai-Hulud has Appeared”.
  • Monitor process execution for the execution of bun binaries in unusual or unexpected locations to identify systems where compromised packages were installed. Deploy the Sigma rule Detect Bun Execution From NPM Package to detect this behavior.
]]>criticalthreatsupply-chainnpmsapcredential-theft