Source URL: https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
Source: Hacker News
Title: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
Feedly Summary: Comments
AI Summary and Description: Yes
Summary: A critical security incident has been identified involving the tj-actions/changed-files GitHub Action, which has been compromised to leak sensitive CI/CD secrets. This incident underscores the urgency for security and compliance professionals to audit their GitHub Actions and take immediate recovery steps to secure their repositories.
Detailed Description: The tj-actions/changed-files GitHub Action, utilized in over 23,000 repositories, has been compromised, leading to the potential exposure of CI/CD secrets in publicly accessible build logs. This incident highlights significant vulnerabilities within CI/CD processes, particularly regarding third-party actions in GitHub.
Key Points:
* **Compromise Overview**: Attackers modified the action’s code and retroactively updated its version tags to point to a malicious commit, compromising the integrity of the action.
* **Exposed Secrets**: CI/CD secrets are being printed in GitHub Actions build logs. Since these logs are public, anyone can access them and potentially steal sensitive information.
* **Detection Method**: StepSecurity’s Harden-Runner platform detected the anomaly via unexpected network traffic linked to the modified action.
* **Malicious Script**: A malicious Python script was introduced that scrapes sensitive data from the GitHub Actions runner process.
* **Recovery Recommendations**:
– Stop using any version of the tj-actions/changed-files Action immediately.
– Conduct a thorough search for instances of this action in repositories.
– Review recent execution logs to identify potential secret leaks.
– Monitor network traffic for calls to known malicious endpoints.
* **Security Measures**: The Harden-Runner solution provides security for CI/CD workflows by controlling network access and monitoring activities, making it critical in responding to and mitigating such incidents.
* **Consulting Support**: A support channel is available for users needing help in investigating the issue.
This incident emphasizes the importance of integrating robust security measures within CI/CD pipelines, particularly when using third-party resources. Compliance professionals should advocate for continuous monitoring and the implementation of security best practices to safeguard sensitive information against similar future exploits.