Horizon Alert
Summary of the vulnerability and why it matters
A privilege escalation vulnerability exists in Pelican's Web User Interface, allowing authenticated users to gain administrator access under specific configurations. This issue demands attention as it could compromise system control.
- Authenticated users can become administrators.
- Affects systems using Pelican's WebUI.
- Compromises data federation control.
Attack Path
How an attacker could exploit the issue
An attacker who has already authenticated into Pelican's WebUI via OAuth can exploit this flaw to escalate their privileges to administrator. This requires a specific configuration to be in place, but if successful, grants full control over the platform.
- Authenticated WebUI user.
- OAuth authentication.
- Specific system configuration.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows authenticated users to gain admin privileges, which is an attractive target. However, its exploitation requires a user to be already authenticated to the WebUI via OAuth, suggesting it's more likely to be used by an insider threat rather than an external attacker. Attackers typically prefer vulnerabilities that grant initial access or do not require pre-existing credentials.
- Exploitation requires OAuth authentication.
- Not listed as KEV.
- Patched in multiple versions.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching affected Pelican WebUI instances to prevent privilege escalation. If immediate patching is not feasible, implement strict access controls and monitor for unauthorized administrative actions.
- Patch to version 7.21.5, 7.22.3, 7.23.3, or 7.24.2.
- Monitor OAuth-authenticated user activity.
