{"id":10349,"date":"2025-03-17T11:01:54","date_gmt":"2025-03-17T11:01:54","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/github-action-flaw-exposes-secrets-in-23k-repos\/"},"modified":"2025-03-17T11:01:56","modified_gmt":"2025-03-17T11:01:56","slug":"github-action-flaw-exposes-secrets-in-23k-repos","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/github-action-flaw-exposes-secrets-in-23k-repos\/","title":{"rendered":"GitHub Action Flaw Exposes Secrets in 23k Repos"},"content":{"rendered":"\n<\/p>\n

Article Published on Mar 17, 2025, by Ravie Lakshmanan<\/strong>
\nTags: Vulnerability \/ Cloud Security<\/strong><\/p>\n

Cybersecurity researchers have identified a concerning incident involving the popular GitHub Action tj-actions\/changed-files<\/code>, which was compromised to leak secrets from repositories using the continuous integration and continuous delivery (CI\/CD) workflow.<\/p>\n

The incident involved the tj-actions\/changed-files<\/code> GitHub Action, utilized in over 23,000 repositories, and is used to track and retrieve all changed files and directories. This supply chain compromise has been assigned the CVE identifier CVE-2025-30066<\/a> (CVSS score: 8.6) and is said to have taken place sometime before March 14, 2025.<\/p>\n

<\/a><\/p>\n

"In this attack, the attackers modified the action’s code and retroactively updated multiple version tags to reference the malicious commit," StepSecurity said<\/a>. "The compromised Action prints CI\/CD secrets in GitHub Actions build logs."<\/p>\n

As a result, should the workflow logs be publicly accessible, they could lead to the unauthorized exposure of sensitive secrets when the action is run on the repositories. This includes AWS access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA Keys, among others. However, there is no evidence that the leaked secrets were siphoned to any attacker-controlled infrastructure.<\/p>\n

Specifically, the maliciously inserted code<\/a> is designed to run a Python script hosted on a GitHub gist that dumps the CI\/CD secrets from the Runner Worker process. It’s said to have originated from an unverified source code commit. The GitHub gist has since been taken down.<\/p>\n

\"tj-actions\/changed-files\"<\/a><\/p>\n

"tj-actions\/change-files is used in an organization’s software development pipelines," Dimitri Stiliadis, CTO and co-founder of Endor Labs, said in a statement shared with The Hacker News. "After developers write and review code, they typically publish into the main branch of their repository. From there ‘pipelines’ take it, build it for production, and deploy it."<\/p>\n

"tj-actions\/change-files helps detect file changes in a repository. It allows you to check which files have been added, modified, or deleted between commits, branches, or pull requests."<\/p>\n

"The attackers modified the action’s code<\/a> and retroactively updated multiple version tags to reference the malicious commit. The compromised Action now executes a malicious Python script that dumps CI\/CD secrets, impacting thousands of CI pipelines."<\/p>\n

The project maintainers have stated that the unknown threat actor(s) behind the incident managed to compromise a GitHub personal access token (PAT) used by @tj-actions-bot, a bot with privileged access to the compromised repository.<\/p>\n

Following the discovery, the account’s password has been updated, authentication has been upgraded to use a passkey, and its permissions levels have been updated such that it follows the principle of least privilege. GitHub has also revoked the compromised PAT.<\/p>\n

"The Personal access token affected was stored as a GitHub action secret which has since been revoked," the maintainers added<\/a>. "Going forward no PAT would be used for all projects in the tj-actions organization to prevent any risk of reoccurrence."<\/p>\n

\"Cybersecurity\"<\/a><\/p>\n

Anyone who uses the GitHub Action is advised to update to the latest version<\/a> (46.0.1) as soon as possible. Users are also advised to review all workflows executed between March 14 and March 15 and check for "unexpected output under the changed-files section."<\/p>\n

This is not the first time a security issue has been flagged in the tj-actions\/changed-files Action. In January 2024, security researcher Adnan Khan revealed<\/a> details of a critical flaw (CVE-2023-49291<\/a>, CVSS score: 9.8) affecting tj-actions\/changed-files and tj-actions\/branch-names that could pave the way for arbitrary code execution.<\/p>\n

The development once again underscores how open-source software remains particularly susceptible to supply chain risks, which could then have serious consequences for several downstream customers at once.<\/p>\n

"As of March 15, 2025, all versions of tj-actions\/changed-files were found to be affected, as the attacker managed to modify existing version tags to make them all point to their malicious code," cloud security firm Wiz said<\/a>.<\/p>\n

"Customers who were using a hash-pinned version of tj-actions\/changed-files would not be impacted, unless they had updated to an impacted hash during the exploitation timeframe."<\/p>\n

Follow us on Twitter<\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/strong><\/p>\n\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Article Published on Mar 17, 2025, by Ravie Lakshmanan Tags: Vulnerability \/ Cloud Security Cybersecurity researchers have identified a concerning incident involving the popular GitHub Action tj-actions\/changed-files, which was compromised…<\/p>\n","protected":false},"author":19,"featured_media":10350,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-10349","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/github.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=10349"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10349\/revisions"}],"predecessor-version":[{"id":10351,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10349\/revisions\/10351"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/10350"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=10349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=10349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=10349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}