GitHub Actions Supply Chain Compromise - tj-actions

[akkem]

tj-actions/changed-files, has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromi...

https://www.upwind.io/feed/github-actions-supply-chain-compromise-tj-actions-changed-files-action

[akkem]

We always recommend using a checksum or digest before deploying anything to a system. If you have verified the SHA value during installation to ensure you're using the correct version of tj-actions, then you are not compromised. Otherwise, regardless of the tag, all versions are vulnerable, as tags can be modified to push the same vulnerable code.

[Kyaw_Myo_Oo]

This is very informative. Thank you for sharing your time and experience with us in this forum @akkem.

[Caute_cautim]

Hi All

A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have originated from an earlier breach of the “reviewdog/action-setup@v1” GitHub Action, according to a report.

Source:  Cryptogram - Bruce Schneier

CISA confirmed the vulnerability has been patched in version 46.0.1.

Given that the utility is used by more than 23,000 GitHub repositories, the scale of potential impact has raised significant alarm throughout the developer community.

Regards

Caute_Cautim

[akkem]

Supply chain and OAuth attacks are on the rise in GitHub, threat campaign targeting over 8,000 repositories with the goal of luring developers into granting full repository access. Mitiga’s researchers explain an active GitHub compromise and large-scale phishing campaign, along with providing recommendations for threat hunting and mitigation.
https://www.mitiga.io/blog/uncovering-hidden-threats-hunting-non-human-identities-in-github?utm_sour...