Compromised aquasecurity/trivy-action detected in GitHub Actions workflows

[ashishkurmi]

Compromised aquasecurity/trivy-action detected — potential secret leak (DEVELOCITY_ACCESS_KEY)

Our automated platform at StepSecurity has detected that this repository used a compromised version of aquasecurity/trivy-action in its GitHub Actions workflows during the recent Trivy incident. Our analysis shows that the impacted workflow job had access to secrets (DEVELOCITY_ACCESS_KEY) that may have been leaked during the compromised run. I have also manually confirmed that the affected workflow run(s) indeed used the compromised action.

What happened?

The aquasecurity/trivy-action GitHub Action was compromised, and a malicious version (v0.69.4) was published. Workflow runs in this repository executed a compromised SHA of this action, which may have exposed sensitive information such as secrets, environment variables, or build artifacts.

For more details on the incident, see StepSecurity Blog: Trivy Compromised a Second Time.

Compromised SHAs detected

• aquasecurity/trivy-action@b7252377a3d82c73d497bfafa3eabe84de1d02c4 (v0.26.0)
• aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1

Secrets exposure assessment

Our analysis shows that the impacted workflow job (Build Pulsar alpine docker image in pulsar-ci.yaml) had access to the following secrets that may have been leaked during the compromised run:

Secret Name	Description
DEVELOCITY_ACCESS_KEY	Develocity (Gradle Enterprise) access key

Affected workflow runs

#	Workflow Run	Build Log (compromised step)	Secrets Accessible
1	23330354895	View compromised action step	DEVELOCITY_ACCESS_KEY
2	23319540170	View compromised action step	DEVELOCITY_ACCESS_KEY
3	23319076147	View compromised action step	DEVELOCITY_ACCESS_KEY
4	23318725583	View compromised action step	DEVELOCITY_ACCESS_KEY
5	23312714678	View compromised action step	DEVELOCITY_ACCESS_KEY

Recommended actions

1. Rotate the DEVELOCITY_ACCESS_KEY secret immediately
2. Review the compromised action step logs linked above for any signs of data exfiltration
3. Audit any systems that the compromised secret provides access to for unauthorized activity
4. Pin GitHub Actions to full-length commit SHAs to prevent future tag-based supply chain attacks

References

• StepSecurity Blog: Trivy Compromised a Second Time

[lhotari]

Recommended actions

1. Rotate the DEVELOCITY_ACCESS_KEY secret immediately
2. Review the compromised action step logs linked above for any signs of data exfiltration
3. Audit any systems that the compromised secret provides access to for unauthorized activity
4. Pin GitHub Actions to full-length commit SHAs to prevent future tag-based supply chain attacks

Thanks, we did the required actions already on Friday. Apache Software Foundation (ASF) Infra team blocked the aquasecurity GitHub Actions completely for the meantime.
Some details of ASF response: https://news.apache.org/foundation/entry/initial-report-on-trivy-security-incident
Trivy action v0.35.0 blocked for now: #25372 (comment)

[lhotari]

Addressed by disabling Trivy action. We'll find a replacement. I'm currently evaluating https://github.com/lhotari/sandboxed-trivy-action which I created.