Description

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-31T09:17:06.790Z",
  "pubdate": "2026-08-31T09:17:06.790Z",
  "executiveSummary": "The vulnerability resides in @hulumi/baseline versions prior to 1.3.2, manifesting as an incomplete detection capability regarding modifications to AWS CloudTrail event selectors.\nThis flaw represents a failure in audit integrity monitoring, as the security baseline fails to flag unauthorized changes to event data selectors.\nThe impact is significant: an attacker who gains sufficient permissions to modify CloudTrail configurations can suppress specific event logging without triggering an alert from @hulumi/baseline.\nThis evasion capability effectively creates a blind spot in the organization's audit trail, allowing malicious activity—such as privilege escalation or data exfiltration—to occur undetected by the baseline monitoring system.\nExploitation requires the attacker to have existing IAM permissions necessary to modify CloudTrail event selectors; the vulnerability exists within the detection logic itself, not the CloudTrail service.\nOrganizations relying on @hulumi/baseline for automated compliance and security monitoring are at risk of compromised visibility until the system is updated to version 1.3.2 or later.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate implementation of detection logic within @hulumi/baseline, which fails to correctly parse or monitor all permutations of CloudTrail event selector configurations.\nCloudTrail event selectors define the types of events that are captured and delivered to logs; attackers can manipulate these selectors to exclude specific API calls, such as those related to IAM policy changes or resource modifications.\nBecause the @hulumi/baseline monitoring engine does not fully validate the integrity of these selectors, it fails to generate the necessary alerts when an event selector is tampered with by a malicious actor.\nThe attack flow typically follows a sequence where an adversary with 'cloudtrail:PutEventSelectors' or 'cloudtrail:UpdateEventSelectors' permissions executes a modification to an existing trail's event selector. The goal is to filter out logs associated with the adversary's subsequent malicious activities.\nUpon modifying the selector, a properly configured security baseline would flag the 'UpdateEventSelectors' or 'PutEventSelectors' API call. However, due to the failure in @hulumi/baseline versions before 1.3.2, the internal state machine or rule set ignores or fails to classify these modifications as high-risk, resulting in a silent failure.\nThis lack of coverage allows for long-term evasion, as the attacker maintains their malicious footprint while keeping the CloudTrail logs free of evidence regarding their unauthorized configuration adjustments.\nThe vulnerable component is the internal monitoring and alerting framework within @hulumi/baseline. The issue affects all instances deployed at versions earlier than 1.3.2. Authentication is required to the AWS environment to facilitate the tampering, but no specific exploitation of @hulumi/baseline itself is needed—the vulnerability is passive, existing in the monitoring system's inability to register the unauthorized state change.\nThe post-exploitation impact includes a complete loss of visibility into unauthorized system changes, rendering the audit trail unreliable for forensic analysis and incident response. This blind spot allows the attacker to operate indefinitely without triggering security alerts that would otherwise notify administrators of infrastructure tampering."
}