N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3mmg-7c2q-8938

GHSA-3mmg-7c2q-8938: `sha-rust` was removed from crates.io for malicious code

It appeared to be attempting to steal credentials from local files.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-3mmg-7c2q-8938

GHSA-3mmg-7c2q-8938:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sha-rust	rust	>= 0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The sha-rust crate was identified as malicious and removed from crates.io. Analysis of the source code, retrieved from external security research, reveals a malicious function named constructor within src/lib.rs. This function is not explicitly called by a user of the library, but is instead designed to execute automatically upon the library being loaded into an application, a side-effect of the #[ctor::ctor] attribute. The function's sole purpose is to steal sensitive credentials. It searches for configuration and credential files for popular cloud and container services, reads their contents, and sends them to a remote server controlled by the attacker. Therefore, any application that includes this crate as a dependency would be compromised, and the constructor function would appear in a runtime profile during the application's startup phase.

Vulnerable functions

constructor

src/lib.rs

The `constructor` function is annotated with `#[ctor::ctor]`, which causes it to be executed automatically when the library is loaded. This function iterates through a list of file paths known to store credentials for various services (AWS, Google Cloud, Kubernetes, Docker), reads their content if they exist, and exfiltrates the data to a hardcoded remote server. This is a clear case of credential theft.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.