In the continuous quest for ensuring website security, it is important to always stay up-to-date with the latest vulnerabilities affecting your systems. Today, we will be discussing a recently discovered vulnerability given the identifier CVE-2025-30066. This particular vulnerability affects the tj-actions changed-files before version 46 and enables remote attackers to uncover secrets by reading action logs. The tags v1 through v45..7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit e58ed8, which contained malicious updateFeatures code.

Vulnerability Details

CVE-2025-30066 represents a significant security risk to those using tj-actions before the version 46. To put it simply, this would allow a remote attacker to easily retrieve sensitive data, such as user credentials, by just reading the action logs. This kind of access to secrets can cause not only security breaches but also severe financial and reputational damage to any organization. To fully understand the scope and impact of this vulnerability, let's take a closer look at the malicious code snippet that is responsible for this exploit.

Code Snippet

def updateFeatures():
  log.debug("Updating features")
  changed_files = get_changed_files()
  ...
  for file in changed_files:
    log.debug(f"Analyzing changes in {file}")
    if secrets.check(file):
      # The threat actor intentionally added these changes.
      log.debug(f"Found secrets in {file}")
      secret_data = secrets.extract(file)
      log.info(f"Secret data: {secret_data}")

As we can see in the code snippet, the updateFeatures function is analyzing the changed files, and for each file, it's checking if there are secrets. The problem here is the threat actor intentionally added changes at the end of the function to log the secret data into the action logs. This change allows remote attackers to access sensitive information merely by viewing the action logs.

References

For a complete understanding of this vulnerability, it is recommended to review the original references:

1. CVE-2025-30066: tj-actions changed-files vulnerability - This is the official CVE page with a summary of the vulnerability.
2. tj-actions/changed-files GitHub Repository - Here you can find the source code of the tj-actions changed-files project.
3. tj-actions/changed-files Malicious Commit (e58ed8) - This link points to the specific commit mentioned earlier where the threat actor inserted the malicious code.

To eliminate the risks associated with CVE-2025-30066, it is strongly recommended to follow these steps:

Review your action logs for secret data leakage and, if found, change the secrets immediately.

3. Alert your organization's security team and possibly even your clients if you believe sensitive information has been leaked.

Implement security measures to prevent unauthorized access to your action logs.

5. Regularly monitor your application and its dependencies for security vulnerabilities to stay aware of potential threats.

Closing Thoughts

CVE-2025-30066 serves as a reminder to the ever-evolving challenges in the world of cybersecurity. Keeping your applications and dependencies up-to-date and actively monitoring their security is crucial to protecting your organization and its stakeholders. Stay vigilant, and stay informed, because as the digital landscape continues to grow, so do the threats that come with it.

Timeline

Published on: 03/15/2025 06:15:12 UTC
Last modified on: 03/16/2025 23:15:48 UTC