{ "id": "CVE-2025-30066", "sourceIdentifier": "cve@mitre.org", "published": "2025-03-15T06:15:12.193", "lastModified": "2025-03-19T20:26:04.510", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)" }, { "lang": "es", "value": "Los archivos modificados de tj-actions anteriores a la versi\u00f3n 46 permiten a atacantes remotos descubrir secretos leyendo los registros de acciones. (Las etiquetas v1 a v45.0.7 se vieron afectadas el 14 y el 15 de marzo de 2025 porque fueron modificadas por un actor de amenazas para apuntar a el commit 0e58ed8, que conten\u00eda c\u00f3digo malicioso de updateFeatures)." } ], "metrics": { "cvssMetricV31": [ { "source": "cve@mitre.org", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 4.0 }, { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 4.0 } ] }, "cisaExploitAdd": "2025-03-18", "cisaActionDue": "2025-04-08", "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability", "weaknesses": [ { "source": "cve@mitre.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-506" } ] }, { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "NVD-CWE-Other" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*", "versionEndIncluding": "45.0.7", "matchCriteriaId": "23B2BE4B-AC69-4088-9ABD-ACDB46ABAA9A" } ] } ] } ], "references": [ { "url": "https://blog.gitguardian.com/compromised-tj-actions/", "source": "cve@mitre.org", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://github.com/chains-project/maven-lockfile/pull/1111", "source": "cve@mitre.org", "tags": [ "Issue Tracking" ] }, { "url": "https://github.com/espressif/arduino-esp32/issues/11127", "source": "cve@mitre.org", "tags": [ "Issue Tracking" ] }, { "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "source": "cve@mitre.org", "tags": [ "Product" ] }, { "url": "https://github.com/modal-labs/modal-examples/issues/1100", "source": "cve@mitre.org", "tags": [ "Issue Tracking" ] }, { "url": "https://github.com/rackerlabs/genestack/pull/903", "source": "cve@mitre.org", "tags": [ "Issue Tracking" ] }, { "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "source": "cve@mitre.org", "tags": [ "Product" ] }, { "url": "https://github.com/tj-actions/changed-files/issues/2463", "source": "cve@mitre.org", "tags": [ "Issue Tracking" ] }, { "url": "https://github.com/tj-actions/changed-files/issues/2464", "source": "cve@mitre.org", "tags": [ "Issue Tracking" ] }, { "url": "https://github.com/tj-actions/changed-files/issues/2477", "source": "cve@mitre.org", "tags": [ "Issue Tracking" ] }, { "url": "https://news.ycombinator.com/item?id=43367987", "source": "cve@mitre.org", "tags": [ "Issue Tracking", "Third Party Advisory" ] }, { "url": "https://news.ycombinator.com/item?id=43368870", "source": "cve@mitre.org", "tags": [ "Issue Tracking", "Third Party Advisory" ] }, { "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "source": "cve@mitre.org", "tags": [ "Mitigation", "Third Party Advisory" ] }, { "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "source": "cve@mitre.org", "tags": [ "Issue Tracking" ] }, { "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "source": "cve@mitre.org", "tags": [ "Exploit", "Mitigation", "Third Party Advisory" ] }, { "url": "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "US Government Resource" ] } ] }