CVE-2023-30853 : Security Advisory and Response

Gradle Build Action data written to GitHub Actions Cache may expose secrets.

Understanding CVE-2023-30853

This CVE impacts users executing a Gradle Build in their GitHub Actions workflow with Gradle Build Action versions prior to 2.4.2.

What is CVE-2023-30853?

A vulnerability in Gradle Build Action allows exposure of secrets configured for the repository in GitHub Actions workflows.

The Impact of CVE-2023-30853

The vulnerability may lead to sensitive information exposure due to the way Gradle Build Tool records environment variables.

Technical Details of CVE-2023-30853

The vulnerability affects users of Gradle Build Action versions below 2.4.2 executing the Gradle Build Tool with the configuration cache enabled.

Vulnerability Description

Secrets configured in GitHub Actions can be exposed via data stored in the GitHub Actions cache, potentially accessible in an untrusted context.

Affected Systems and Versions

Users running Gradle Build Action with versions < 2.4.2 are impacted by this vulnerability.

Exploitation Mechanism

The vulnerability allows secrets passed to the Gradle Build Tool via environment variables to be persisted in the GitHub Actions cache.

Mitigation and Prevention

Take immediate steps to address the vulnerability and prevent potential exposure of sensitive information.

Immediate Steps to Take

Upgrade to Gradle Build Action v2.4.2 or newer to prevent further leakage of secrets into the GitHub Actions Cache.

Long-Term Security Practices

Manually delete potentially vulnerable cache entries from the GitHub UI to mitigate risks of sensitive data exposure.

Patching and Updates

Delete or let cache entries expire naturally to remove vulnerability from previous cache entries. Consider rotating potentially affected secrets for enhanced security measures.