A security issue (CVE-2021-41077) has been discovered in the Travis CI continuous integration service, designed for testing and building projects developed on GitHub and Bitbucket. This flaw allows the contents of confidential environment variables in public repositories using Travis CI to be exposed. The vulnerability also reveals keys used in Travis CI for generating digital signatures, access keys, and tokens for API calls.
The issue was present in Travis CI from September 3 to 10. Notably, information about the vulnerability was communicated to developers on September 7, but the only response received was a generic suggestion to implement key rotation. After not receiving adequate feedback, researchers reached out to GitHub and suggested blacklisting Travis. The problem was addressed only on September 10, following numerous complaints from various projects. After the incident, an odd report regarding the issue was published on the Travis CI website, which contained only a context-free recommendation to cyclically change access keys instead of informing users about the vulnerability fix.
Following outrage over the concealment of information expressed by several major projects, a more detailed report was published on the Travis CI support forum. This report warned that the owner of a fork of any public repository could initiate the build process through a pull request and gain unauthorized access to sensitive environment variables of the original repository. These variables are exposed during the build based on fields from the '.travis.yml' file or defined through the Travis CI web interface. Such variables are stored in an encrypted form and are decrypted only during the build. The problem only affected publicly accessible repositories with forks (private repositories were not vulnerable).
Source: opennet.ru
