Mar 17, 2025Ravie LakshmananVulnerability / Cloud Safety

Cybersecurity researchers are calling consideration to an incident during which the favored GitHub Motion tj-actions/changed-files was compromised to leak secrets and techniques from repositories utilizing the continual integration and steady supply (CI/CD) workflow.

The incident concerned the tj-actions/changed-files GitHub Motion, which is utilized in over 23,000 repositories. It is used to trace and retrieve all modified recordsdata and directories.

The availability chain compromise has been assigned the CVE identifier CVE-2025-30066 (CVSS rating: 8.6). The incident is alleged to have taken place someday earlier than March 14, 2025.

“On this assault, the attackers modified the motion’s code and retroactively up to date a number of model tags to reference the malicious commit,” StepSecurity stated. “The compromised Motion prints CI/CD secrets and techniques in GitHub Actions construct logs.”

The web results of this habits is that ought to the workflow logs be publicly accessible, they might result in the unauthorized publicity of delicate secrets and techniques when the motion is run on the repositories.

This contains AWS entry keys, GitHub Private Entry Tokens (PATs), npm tokens, and personal RSA Keys, amongst others. That stated, there isn’t any proof that the leaked secrets and techniques have been siphoned to any attacker-controlled infrastructure.

Particularly, the maliciously inserted code is designed to run a Python script hosted on a GitHub gist that dumps the CI/CD secrets and techniques from the Runner Employee course of. It is stated to have originated from an unverified supply code commit. The GitHub gist has since been taken down.

“tj-actions/change-files is utilized in a corporation’s software program growth pipelines,” Dimitri Stiliadis, CTO and co-founder of Endor Labs, stated in a press release shared with The Hacker Information. “After builders write and assessment code, they sometimes publish into the principle department of their repository. From there ‘pipelines’ take it, construct it for manufacturing, and deploy it.”

“tj-actions/change-files helps detect file modifications in a repository. It permits you to examine which recordsdata have been added, modified, or deleted between commits, branches, or pull requests.”

“The attackers modified the motion’s code and retroactively up to date a number of model tags to reference the malicious commit. The compromised Motion now executes a malicious Python script that dumps CI/CD secrets and techniques, impacting hundreds of CI pipelines.”

Cybersecurity agency Sysdig stated the compromise of tj-actions/changed-files highlights the rising threat of provide chain assaults in CI/CD environments. Aqua, which additionally examined the difficulty, famous that the malicious payload was “rigorously hid” to evade detection by automated scanning instruments.

The mission maintainers have acknowledged that the unknown menace actor(s) behind the incident managed to compromise a GitHub private entry token (PAT) utilized by @tj-actions-bot, a bot with privileged entry to the compromised repository.

Following the invention, the account’s password has been up to date, authentication has been upgraded to make use of a passkey, and its permissions ranges have been up to date such that it follows the precept of least privilege. GitHub has additionally revoked the compromised PAT.

“The Private entry token affected was saved as a GitHub motion secret which has since been revoked,” the maintainers added. “Going ahead no PAT could be used for all tasks within the tj-actions group to forestall any threat of reoccurrence.”

Anybody who makes use of the GitHub Motion is suggested to replace to the newest model (46.0.1) as quickly as potential. Customers are additionally suggested to assessment all workflows executed between March 14 and March 15 and examine for “surprising output underneath the changed-files part.”

This isn’t the primary time a safety challenge has been flagged within the tj-actions/changed-files Motion. In January 2024, safety researcher Adnan Khan revealed particulars of a vital flaw (CVE-2023-49291, CVSS rating: 9.8) affecting tj-actions/changed-files and tj-actions/branch-names that would pave the best way for arbitrary code execution.

The event as soon as once more underscores how open-source software program stays significantly inclined to produce chain dangers, which may then have severe penalties for a number of downstream prospects without delay.

“As of March 15, 2025, all variations of tj-actions/changed-files have been discovered to be affected, because the attacker managed to change current model tags to make all of them level to their malicious code,” cloud safety agency Wiz stated.

“Prospects who have been utilizing a hash-pinned model of tj-actions/changed-files wouldn’t be impacted, until that they had up to date to an impacted hash throughout the exploitation timeframe.”

A proof-of-concept (PoC) exploit has been launched for a use-after-free vulnerability within the Linux kernel, recognized as CVE-2024-36904.

This vulnerability is situated within the TCP subsystem of the Linux kernel and is attributable to the inet_twsk_hashdance() perform inserting the time-wait socket into the established hash desk earlier than setting its reference counter.

CVE Overview

CVE-2024-36904 impacts the Linux kernel by permitting an attacker to use a use-after-free situation, which might doubtlessly result in arbitrary code execution or denial-of-service assaults.

The vulnerability was found throughout an investigation that concerned making a modified kernel with KASAN (Kernel Handle Sanitizer) enabled to substantiate the presence of an actual use-after-free problem.

Affected Methods

The vulnerability was examined on methods operating Alma Linux 9 with kernel model 5.14.0-362.24.2.el9_3.x86_64, however it’s probably that different variations of the Linux kernel are additionally affected in the event that they haven’t been patched.

The vulnerability was fastened in Pink Hat Enterprise Linux 9 on kernel model 5.14-427.26.1 as of July 16, 2024.

Proof of Idea (PoC) Code

For these excited by testing the vulnerability, a PoC exploit named CVE-2024-36904-trigger is out there.

To check the vulnerability with KASAN enabled, you’ll need to use a patch to the kernel after which construct it. Listed here are the steps to use the patch:

1. Set up obligatory packages:
   You have to flex, bison, elfutils-libelf-devel, openssl-devel, bc, perl, and dwarves put in to construct the kernel.
2. Apply the patch:

cd kernels/linux-5.14.0-362.24.1.el9_3/

patch -n1 < ../mdelay_remove_rcu_flag.patch

3. Construct the kernel:

cp ../linux-5.14.0-362.24.1.el9_3-RESEARCH-KASAN/.config .config

make oldconfig

make -j `nproc`

make -j `nproc` modules_install set up

Operating the Set off

To run the set off and observe the KASAN splat when utilizing the modified kernel, execute the next command in a loop:

whereas true; do ./CVE-2024-36904-trigger; completed

This command will constantly execute the set off, which ought to trigger the KASAN splat to seem within the kernel ring buffer inside a brief interval when utilizing the modified kernel.

CVE-2024-36904 highlights the significance of well timed patching and testing of Linux kernel vulnerabilities.

As Linux distributions proceed to replace their kernels to handle such vulnerabilities, guaranteeing that your system is up to date is essential for sustaining safety.

Customers and organizations ought to preserve their Linux kernels up-to-date to guard in opposition to exploits concentrating on this and different vulnerabilities.

Are you from SOC/DFIR Groups? – Analyse Malware Incidents & get dwell Entry with ANY.RUN -> Begin Now for Free.