Hackers target 61 GitHub repositories with command injection to steal CI/CD secrets
VULNERABILITYredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Attackers posted specially crafted issues, pull requests and comments on 61 public GitHub projects. Automated tools in some of those projects ran the hidden commands, which tried to collect secret settings used by software build systems. The researchers did not confirm that any secrets were actually stolen.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Maintainers should pass untrusted issue and pull request titles through environment variables rather than inserting them into shell scripts, avoid eval, and limit workflow permissions.
- Teams finding evidence of execution should review which secrets were available to the affected jobs and rotate any that may have been exposed.
- Inspect audit logs and investigate any unexpected outbound connections from CI/CD workflows, including traffic to the external IP on port 8443 described in the research.
- Keep notification jobs separate from privileged release workflows to limit what an injected command could reach.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News