Pelican Web UI Affected by a Privilege Escalation Attack

Attack Preconditions

Both attacks share the same prerequisites:

1. The server's OIDC logins must be enabled.
2. The attacker must have some form of authenticated session on the server, typically from an OIDC login.
3. The attacker must know or guess a relevant admin identifier (a Server.UIAdminUsers username or a Server.AdminGroups group name) for an admin who has not previously logged into the WebUI.

Immediate Mitigation Steps

1. Audit the consuming service's database

Before upgrading, Pelican Command Line recommends auditing the service's database to see if it has already been exploited and to block further exploitation. Upgrading an exploited server is insufficient to prevent future unauthorized access if the exploit has already occurred.

Pelican Command Line is providing a script mitigate-user-escalation.sh that:

• Displays all user records and group memberships for manual review, highlighting any that show fingerprints of the attack with [!] for explicit review — administrators should verify all entries, but especially those with this syntax highlighting. The highlighted changes do not guarantee an exploit occurred but that further examination is needed.
• Creates database records mitigating the attack vector.
• Displays all API tokens, which may have been created by an attacker for persistent access, for administrator review. Suspicious tokens should be deleted using the provided SQLite commands.
• Provides additional guidance about rotating secrets on the server.

This script is available as a github gist: https://gist.github.com/jhiemstrawisc/8c4b2b3ec5cb2ca06537d9439dc16cc9

To run the script:

# Run as the same user that runs the Pelican server (e.g., pelican):
$ sudo bash mitigate-user-escalation.sh

# If using a non-standard config file:
$ sudo bash mitigate-user-escalation.sh --config /path/to/pelican.yaml

# If the database is in a non-standard location:
$ sudo bash mitigate-user-escalation.sh --db-path /path/to/pelican.sqlite

2. Upgrade to a patched version

Administrators for Pelican servers running an affected version should upgrade to a patched release. Within each minor release series, these versions include:

• >=v7.21.5
• >=v7.22.3
• >=v7.23.3
• >=v7.24.2

Administrators can check their server's version by invoking pelican with the --version flag, or by inspecting the WebUI's ? icon displayed in the lower left corner.

3. Disable vulnerable configuration if not upgrading immediately

If administrators are unable to upgrade to a patched version, disable the vulnerable configuration by commenting or removing the relevant settings from the service's pelican.yaml:

Server:
  # Comment or remove these lines:
  # UIAdminUsers:
  #   - user1
  #   - user2
  # AdminGroups:
  #   - admin-group

Note: Disabling Server.UIAdminUsers removes OIDC-based admin access entirely, leaving only password-based login for admin access. Ensure the project has a working admin password before making this change.

If a server doesn't currently configure Server.UIAdminUsers or Server.AdminGroups, do not populate these settings until the administrator has upgraded to a patched version. If their project doesn't currently have these configured but have in the past, they should still audit the records using the provided mitigation script.

Long-Term Fixes

In addition to closing the immediate vulnerabilities, the Pelican development team is working toward several defense-in-depth solutions to minimize the risk of similar vulnerabilities in the future. These include:

• Reviewing all code in the vicinity of these vulnerabilities for other attack vectors.
• Changing internal frameworks so security implications of new APIs are more visible to code reviewers.
• Automating security scanning using coding agents like the one that discovered this class of vulnerabilities.