CRITICAL SECURITY ADVISORY: Repository compromised - Malware injected in all Git Tags

[cyril-flieller]

We have identified that this repository has been compromised. A malicious script has been injected into all existing Git tags. While the master branch currently appears clean, every release tag now points to a malicious commit that was not authored by the original maintainers.

The injected code is a sophisticated Infostealer designed to:

• Steal Secrets: Scans for AWS, Azure, GCP credentials, SSH keys, and Kubernetes tokens

• Memory Dump: Extracts secrets directly from the RAM of CI/CD runners (targeting Runner.Worker)

• Exfiltrate Data: Encrypts stolen data and sends it to an external server (checkmarx.zone) or creates a hidden release in a rogue repository using the victim's GITHUB_TOKEN

• Persistence: Attempts to install a backdoor via a systemd service (sysmon) and deploy privileged pods in Kubernetes clusters

➡️ https://github.com/Checkmarx/kics-github-action/blob/v2.1.20/setup.sh

[cyril-flieller]

@cx-artur-ribeiro

[cx-artur-ribeiro]

We are currently investigating the issue, thanks for the warning!
We will make the necessary changes as soon as possible!

[cx-bruno-silva]

The issue is resolved now.

[riuvshyn]

hello, do we know when malicious versions were deployed?

[yverry]

Today around 12:00 CET
A clear communication is needed

[riuvshyn]

does anyone still have a copy of the setup.sh ? Having that would help a lot to understand potential impact.

[codymaust]

does anyone still have a copy of the setup.sh ? Having that would help a lot to understand potential impact.

these articles go into some great detail

https://www.wiz.io/blog/teampcp-attack-kics-github-action

https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions#the-checkmarx-wave

[aamir-consensys]

does anyone still have a copy of the setup.sh ? Having that would help a lot to understand potential impact.

You can see it in the commit here: 8e20c7a

[sofianlak]

Hi! is it possible to create a GitHub Advisory Database in security tab please ?
this need to be documented for people using it.

[codymaust]

@cx-artur-ribeiro @cx-bruno-silva

can you please share which tags in this repository were compromised? there is a lot of conflicting information out there

i came across some information that indicates that only v1.1 was compromised? but other security research blogs have claimed contrary information

we were pointing to other versions (v2 and v1.7.0), but went ahead and assumed compromise and rolled secrets accordingly

EDIT: and thank you to @cyril-flieller for identifying and creating this github issue!

[cx-nuno-oliveira]

Hi everyone,

you can find the official communication here: https://checkmarx.com/blog/checkmarx-security-update/
Please, follow the recommendations therein.

Meanwhile, we have ongoing investigations to get further details.

Thank you all!

[bsgrigorov]

Can you also pin the digest of the docker image so that a poisoned docker image tag cannot make it into the Actions. Right now even if we SHA-pin the github action, it still pulls the image 2.1.20 which can be poisoned.
https://github.com/Checkmarx/kics-github-action/blob/master/Dockerfile#L1

[bsuv]

@cx-nuno-oliveira @cx-bruno-silva can you also please SHA-pin the semver tag in the Dockefile vs reference a tag (which may be mutable ob Docker Hub)

[bsgrigorov]

#155