Full Report
A cascading supply chain attack that began with the compromise of the "reviewdog/action-setup@v1" GitHub Action is believed to have led to the recent breach of "tj-actions/changed-files" that leaked CI/CD secrets. [...]
Analysis Summary
# Incident Report: Cascading GitHub Action Supply Chain Compromise
## Executive Summary
Security researchers uncovered a supply chain attack originating from a compromise of the `reviewdog/action-setup@v1` GitHub Action, which subsequently created the risk of a cascading attack against other `reviewdog` actions. The impact involves the potential compromise of CI/CD secrets within dependent repositories if the malicious action was executed and the attacker successfully exfiltrated data via logs. Response actions focused on internal remediation by the maintainer, followed by recommendations for users to immediately audit references, delete logs, and rotate secrets, while pinning actions to specific commits for future prevention.
## Incident Details
- **Discovery Date:** Not explicitly stated, but discovered by Wiz security researchers.
- **Incident Date:** Not explicitly stated, but relates to the compromise of GitHub Actions.
- **Affected Organization:** Reviewdog project contributors/ecosystem.
- **Sector:** Software Development / CI/CD Technology Supply Chain.
- **Geography:** Global (GitHub infrastructure).
## Timeline of Events
### Initial Access
- **Date/Time:** Unknown prior to researcher discovery.
- **Vector:** Compromise of a specific version tag of a GitHub Action (`reviewdog/action-setup@v1`).
- **Details:** The exact method of the initial breach into the Reviewdog project's repository or the specific action file is undetermined. The risk suggests an attacker was able to inject malicious code into the action.
### Lateral Movement
- **Details:** The attack vector was designed to potentially lead to a *cascading supply chain attack*. If the initial compromise was successful, any repository using the compromised action could potentially have its CI/CD secrets exposed, allowing subsequent attacks against those dependent projects (e.g., a repeat attack on `tj-actions/changed-files`).
### Data Exfiltration/Impact
- **Details:** The primary impact mechanism involves the potential exfiltration of **CI/CD secrets** from dependent repositories if the compromised action was executed in a workflow. The mechanism for confirming exfiltration is searching workflow logs for double-encoded base64 payloads.
### Detection & Response
- **How it was discovered:** Discovered and analyzed by the security team at Wiz.
- **Response actions taken:** The security breach at Reviewdog was incidentally remediated. The maintainers informed GitHub and the team of their findings to prevent reoccurrence.
## Attack Methodology
- **Initial Access:** Injection of malicious code via update/commit to a widely used GitHub Action version tag (`reviewdog/action-setup@v1`).
- **Persistence:** Not detailed, but the compromise allowed the malicious code to execute when the action was run.
- **Privilege Escalation:** Not detailed, but leveraged privileges granted via the CI/CD environment context.
- **Defense Evasion:** By using legitimate, trusted GitHub Action infrastructure.
- **Credential Access:** Likely harvesting secrets passed into the running workflow environment.
- **Discovery:** Not detailed, but reconnaissance within the compromised CI/CD environment would be expected.
- **Lateral Movement:** Potential for cascading to dependent projects using other `reviewdog` actions if they were also compromised or if the initial breach provided a foothold.
- **Collection:** Harvesting of CI/CD secrets, detectable via double-encoded base64 payloads in workflow logs.
- **Exfiltration:** Implied exfiltration of collected secrets (though details are sparse).
- **Impact:** Potential exposure/theft of sensitive development secrets and keys.
## Impact Assessment
- **Financial:** Not quantified.
- **Data Breach:** CI/CD secrets/credentials from dependent repositories.
- **Operational:** Disruption to workflows triggered by the compromised action; requires immediate remediation of secrets.
- **Reputational:** Negative impact on trust in the Reviewdog ecosystem and supply chain security.
## Indicators of Compromise
- **Network indicators:** Not disclosed (defanged).
- **File indicators:** Not disclosed.
- **Behavioral indicators:** Presence of double-encoded base64 payloads in workflow logs of repositories using the affected actions.
## Response Actions
- **Containment measures:** Remediation of the initial breach by Reviewdog maintainers (which was incidentally performed).
- **Eradication steps:** Users must immediately remove all references to affected actions across branches, and delete relevant workflow logs.
- **Recovery actions:** Affected parties must rotate any potentially exposed secrets immediately.
## Lessons Learned
- **Key takeaways:** Automated invites for new contributors increase the inherent risk profile of open-source projects relying on widely used infrastructure like GitHub Actions.
- **What could have been done better:** The reliance on version tags (e.g., `@v1`) instead of specific commit hashes makes supply chain attacks easier to sustain across many downstream projects.
## Recommendations
- Pin GitHub Actions to **specific commit hashes** instead of using version tags to prevent the substitution of malicious code into existing versions.
- Utilize **GitHub's allow-listing feature** to restrict the execution of unauthorized actions within organizational repositories.
- Development teams must use the provided search query to audit their own codebases for usage of deprecated/compromised `@reviewdog` actions.