Aqua Security has published the results of a study on the presence of sensitive data in build logs that are publicly accessible in the Travis CI continuous integration system. Researchers found a way to extract 770 million logs from various projects. During a test upload of 8 million logs, approximately 73,000 tokens, credentials, and access keys related to various popular services, including GitHub, AWS, and Docker Hub, were identified. The leaked information could compromise the infrastructure of many open-source projects; for instance, a similar leak recently led to a breach of the NPM project's infrastructure.
The leak is related to the ability to access user logs of the free Travis CI service through its standard API (for example, a build log can be downloaded via a URL like "https://api.travis-ci.org/v3/job/5248126/log.txt", where 5248126 is the log identifier). To determine the range of possible log identifiers, another API was used ("https://api.travis-ci.org/logs/6976822"), which provides a redirect to download the log by its sequence number. Through iterative testing, the researchers were able to identify around 770 million logs created from 2013 to May 2022 during the builds of projects falling under the free tier without authentication.
The analysis of the test sample revealed that in many cases, the logs openly reflected access parameters to repositories, APIs, and storage sufficient for accessing private repositories, making code changes, or connecting to cloud environments used in the infrastructure. For example, tokens for connecting to repositories on GitHub, passwords for hosting builds on Docker Hub, access keys for Amazon Web Services (AWS) environments, and connection parameters for MySQL and PostgreSQL databases were found in the logs.
Notably, similar leaks through APIs were documented by researchers in 2015 and 2019. Following past incidents, Travis implemented certain restrictions to hinder mass data downloads and limited API access, but these restrictions have been circumvented. Additionally, Travis attempted to clean sensitive data in the logs, but the data was only partially cleansed.
The leak primarily affected users of open projects who are given free access to Travis's continuous integration service. During checks conducted by several service providers, it was confirmed that about half of the tokens and keys extracted from the logs remain active. All users of the free version of Travis CI are strongly advised to urgently change their access keys, set up the deletion of build logs, and ensure that no confidential data is output in the logs.
Source: opennet.ru
