Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

Post by prepend » Sat, Mar 15, 2025, 5:23 PM UTC

h4ck_th3_pl4n3t wrote: post #106

mubou wrote: post #6

In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…

The alternative would be to find a sustainable funding model for open source, which is the source of betrayals due to almost all of the maintainers having to sell their projects to make a living in the first place. The problem you're describing is an economical and a social one. Currently, companies exploit maintainers of open source projects. There are rarely projects that make it due to their popularity, like webpa…

Post by onnimonni » Sat, Mar 15, 2025, 5:29 PM UTC

onnimonni wrote: post #229

It seems pretty awful that the de-facto way to use GitHub Actions is using git tags which are not immutable. For example to checkout code [1]: - uses: actions/checkout@v4 Github does advise people to harden their actions by referring to git commit hashes [2] but Github currently only supports SHA-1 as hashing algorithm. Creating collisions with this hashing algo will be more and more affordable and I'm afraid that we…

Post by 3eb7988a1663 » Sat, Mar 15, 2025, 5:51 PM UTC

simonw wrote: post #13

I've always felt uncomfortable adding other people's actions to my GitHub workflows, and this is exactly the kind of thing I was worried about. I tend to stick to the official GitHub ones (actions/setup-python etc) plus the https://github.com/pypa/gh-action-pypi-publish one because I trust the maintainers to have good security habits.

Post by Y_Y » Sat, Mar 15, 2025, 6:03 PM UTC

onnimonni wrote: post #234

onnimonni wrote: post #229

It seems pretty awful that the de-facto way to use GitHub Actions is using git tags which are not immutable. For example to checkout code [1]: - uses: actions/checkout@v4 Github does advise people to harden their actions by referring to git commit hashes [2] but Github currently only supports SHA-1 as hashing algorithm. Creating collisions with this hashing algo will be more and more affordable and I'm afraid that we…

I wasn't aware of the already existing SHA-1 collision support created by Github. It's very interesting read and AFAIK it seems that using SHA-1 collisions is not possible: https://github.blog/news-insights/company-news/sha-1-collisi... Is anyone aware of a git hook I could use to analyse my .github/workflows/*.yml files and replace git tags like "v4" with the current git commit hashes? I think this would make it muc…

  #!/bin/sh
  for file in .github/workflows/*.yml; do
    grep -E "uses:[[:space:]]+[A-Za-z0-9._-]+/[A-Za-z0-9._-]+@v[0-9]+" "$file" | while read -r line; do
      repo=$(echo "$line" | sed -E 's/.*uses:[[:space:]]+([A-Za-z0-9._-]+\/[A-Za-z0-9._-]+)@v[0-9]+.*/\1/')
      tag=$(echo "$line" | sed -E 's/.*@((v[0-9]+)).*/\1/')
      commit_hash=$(git ls-remote "https://github.com/$repo.git" "refs/tags/$tag" | awk '{print $1}')
      [ -n "$commit_hash" ] && sed -i.bak -E "s|(uses:[[:space:]]+$repo@)$tag|\1$commit_hash|g" "$file" && git add "$file" && rm -f "$file.bak"
    done
  done
  exit 0

Post by mongrelion » Sat, Mar 15, 2025, 6:23 PM UTC

v1sionSec wrote: post #198

imnotjames wrote: post #187

Earlier quoted context omitted.

Your secrets will be published to the CI log if you were affected. I believe it's everything since around 10pm ET last night. I would consider any runs in the past 24 hours to be suspect.

Thank you, unfortunately we have a multiple of repositories with multiple runs that use this action so checking the logs one by one will be hard. Any idea how to get all logs? Thank you