tj-actions/changed-files信息泄露漏洞

详细信息

漏洞类型

其他

漏洞描述

tj-actions/changed-files tags v1至v45.0.7版本（含 45.0.7）存在嵌入恶意代码漏洞，远程攻击者可通过读取操作日志发现机密信息。这些机密信息包括但不限于有效的AWS访问密钥、GitHub个人访问令牌（PAT）、npm令牌和RSA私钥。这是由于威胁行为者修改了这些tags，使其指向包含恶意updateFeatures代码的commit 0e58ed8所致。

修复建议

应用2f7c5bfce28377bc069a65ba478de0a74aa0ca32补丁，或升级到46.0.1或更高版本。参考链接： https://github.com/tj-actions/changed-files/commit/2f7c5bfce28377bc069a65ba478de0a74aa0ca32 (https://github.com/tj-actions/changed-files/releases/tag/v46.0.1

参考链接

• https://blog.gitguardian.com/compromised-tj-actions/

  CVE · Third Party Advisory · Exploit

• https://github.com/advisories/GHSA-mrrh-fwg8-r2c3

  GitHub

• https://github.com/chains-project/maven-lockfile/pull/1111

  CVE · Issue Tracking

• https://github.com/espressif/arduino-esp32/issues/11127

  CVE · Issue Tracking

• https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193

  CVE · Product

• https://github.com/modal-labs/modal-examples/issues/1100

  CVE · Issue Tracking

• https://github.com/rackerlabs/genestack/pull/903

  CVE · Issue Tracking

• https://github.com/tj-actions/changed-files

  OSV

• https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28

  CVE · Product

• https://github.com/tj-actions/changed-files/issues/2463

  CVE · Issue Tracking

• https://github.com/tj-actions/changed-files/issues/2464

  CVE · Issue Tracking

• https://github.com/tj-actions/changed-files/issues/2477

  CVE · Issue Tracking

• https://github.com/tj-actions/changed-files/releases/tag/v46.0.1

  GitHub

• https://news.ycombinator.com/item?id=43367987

  CVE · Third Party Advisory · Issue Tracking

• https://news.ycombinator.com/item?id=43368870

  CVE · Third Party Advisory · Issue Tracking

• https://nvd.nist.gov/vuln/detail/CVE-2025-30066

  GitHub

• https://osv.dev/vulnerability/CVE-2025-30066

  OSV

• https://osv.dev/vulnerability/GHSA-mrrh-fwg8-r2c3

  OSV

• https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/

  CVE · Third Party Advisory

• https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/

  CVE · Third Party Advisory · Mitigation

• https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463

  CVE · Issue Tracking

• https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

  CVE · Mitigation · Third Party Advisory · Exploit

• https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond

  CVE · Third Party Advisory

• https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack

  CVE · Third Party Advisory

• https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066

  CVE · Third Party Advisory

• https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066

  OSV · Third Party Advisory · US Government Resource

• https://web.archive.org/web/20250315060250/

  CNNVD

• https://access.redhat.com/security/cve/cve-2025-30066

  CNNVD

• https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066

  OSV · Third Party Advisory · Mitigation

• https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised

  OSV · Third Party Advisory

• https://blog.gitguardian.com/compromised-tj-actions

  OSV · Third Party Advisory · Exploit

• https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x5m5

  GitHub

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066

  OSV · US Government Resource