A Travis CI continuous integration service designed for testing and building projects developed on GitHub and Bitbucket has revealed a security issue (CVE-2021-41077) that allows access to the contents of sensitive environment variables in public repositories using Travis CI. This vulnerability also exposes the keys for generating digital signatures, access keys, and tokens used to interact with the API.
The issue was present in Travis CI from September 3 to 10. Notably, the information regarding the vulnerability was passed to the developers on September 7, but only a generic response was received recommending the rotation of keys. After receiving insufficient feedback, the researchers contacted GitHub and proposed blacklisting Travis. The problem was resolved only on September 10 after a large number of complaints from various projects. Following the incident, a rather strange report about the issue was published on the Travis CI website, which instead of informing about the vulnerability fix contained only the aforementioned out-of-context recommendation to cyclically change access keys.
After the outrage expressed by several large projects regarding the concealment of information, a more detailed report was published on the Travis CI support forum, warning that the owner of a fork of any public repository could initiate the build process through a pull request and gain unauthorized access to the sensitive environment variables of the source repository, exposed during the build based on fields from the '.travis.yml' file or defined through the Travis CI web interface. Such variables are stored in an encrypted form and decrypted only during the build. The issue only affected publicly accessible repositories with forks (private repositories are not vulnerable to this attack).
Forrás: opennet.ru
