GitHub Actions Supply Chain Attack

What is the Attack?

What is the recommended Mitigation?

Review Github Advisory posted at tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs. · CVE-2025-30066 · GitHub Advisory Database · GitHub and follow Mitigation steps as mentioned below:

1. Identify usage: Search for the tj-actions/changed-files action and other actions mentioned above in your repositories to determine whether and where it has been used.

2. Review workflow logs: Examine past workflow runs for evidence of secret exposure and update workflows referencing the compromised commit.

3. Rotate potentially exposed secrets: As a precaution, rotate any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.

4. Investigate malicious activity: If you encounter any signs that the compromised action has been executed, investigate further for any signs of malicious activity.

See the following additional resource for further guidance:
Security hardening for GitHub Actions - GitHub Docs

What FortiGuard Coverage is available?

• FortiGuard Labs recommends users to follow instructions and mitigation steps as mentioned on the vendor’s advisory.

• The FortiGuard Incident Response team can be engaged to help with any suspected compromise.

• FortiGuard IPS signature is added to detect and block any malicious activity related to CVE-2025-30066 and CVE-2025-30154. Intrusion Prevention | FortiGuard Labs

• Lacework FortiCNAPP provides the following post-exploitation and CI/CD protection capabilities:
  - Anomalous Cloud Activity: Detects unusual access patterns, use of stolen credentials, and suspicious API behavior across AWS, Azure, and GCP.
  - CI/CD Integration: Enables detection of insecure infrastructure code and secrets during build workflows. FortiCNAPP scan results can be used to fail builds and prevent deployment of high-severity risks when integrated with CI/CD pipelines (e.g. GitHub Actions, GitLab CI)
  - Workload Threat Detection: Identifies runtime behaviors such as encoded exfiltration attempts, unexpected process activity, or behavior indicative of credential harvesting.
  - IaC and Secrets Scanning: Prevents misconfigurations and hardcoded secrets in Terraform, Kubernetes, and CI workflows.

• FortiGuard Labs will provide updates as more information becomes available.