Added script to find and decode leaked secrets

Author: aegilops

find_compromised_secrets.js

@@ -0,0 +1,106 @@
+/* Script to find compromised secrets in an Actions workflow run.
+
+Only relevant to a particular series of incidents, where a malicious actor
+pushed a commit to a repository that contained a workflow that leaked secrets
+into the logs.
+
+They were doubly-Base64 encoded, so we need to spot Base64 strings and decode them.
+*/
+
+import { Octokit } from "@octokit/rest";
+import fs from "fs";
+import AdmZip from "adm-zip";
+import { findSecretsInLines, base64Regex } from "./find_compromised_secrets_helper.js";
+
+// Initialize Octokit with a personal access token
+const octokit = new Octokit({
+  auth: process.env.GITHUB_TOKEN, // Set your GitHub token in an environment variable
+  baseUrl: process.env.GITHUB_BASE_URL, // Set the GitHub base URL, e.g. for Enterprise Server, in an env var
+});
+
+// Helper function to extract secrets leaked into workflow logs
+async function extractSecretsFromLogs(logUrl) {
+  try {
+    const response = await octokit.request(`GET ${logUrl}`, {
+      headers: { Accept: "application/vnd.github+json" },
+    });
+
+    // get the zip file content
+    const zipBuffer = Buffer.from(response.data);
+
+    // Unzip the file
+    const zip = new AdmZip(zipBuffer);
+    const logEntries = zip.getEntries();
+
+    const secrets = [];
+
+    // Iterate through each file in the zip
+    for (const entry of logEntries) {
+      if (!entry.isDirectory) {
+        const fileName = entry.entryName;
+        if (fileName.startsWith("0_")) {
+          const logContent = entry.getData().toString("utf8");
+
+          let lines = logContent.split("\n");
+
+          secrets.push(...findSecretsInLines(lines, base64Regex));
+        }
+      }
+    }
+    return secrets;
+  } catch (error) {
+    console.error(`Failed to fetch logs from ${logUrl}:`, error.message);
+    return [];
+  }
+}
+
+async function main() {
+  // Parse CLI arguments
+  const args = process.argv.slice(2);
+
+  if (args.length > 0) {
+    console.error(
+      "Usage: node find_compromised_secrets.js < <input file>"
+    );
+    return;
+  }
+
+  // read the actions runs from STDIN, in single-line JSON format
+  const actions_run_lines = fs.readFileSync(0).toString().split("\n");
+  
+  const all_secrets = [];
+
+  for (const line of actions_run_lines) {
+    if (line == "" || !line.startsWith("{")) {
+      continue;
+    }
+
+    try {
+      const actions_run = JSON.parse(line);
+
+      const owner = actions_run.org;
+      const repo = actions_run.repo;
+      const run_id = actions_run.run_id;
+  
+      console.log(`Processing actions run ${owner}/${repo}#${run_id}...`);
+
+      // get the logs for the run
+      const logUrl = `/repos/${owner}/${repo}/actions/runs/${run_id}/logs`;
+      const secrets = await extractSecretsFromLogs(logUrl);
+
+      console.log(`Found ${secrets.length} secrets in log for ${owner}/${repo}#${run_id}`);
+
+      for (const secret of secrets) {
+        console.log(secret);
+      }
+
+      all_secrets.push(...secrets);
+    }
+    catch (error) {
+      console.error(`Failed to parse line: ${line}`);
+      continue;
+    }
+  }
+}
+
+await main();

find_compromised_secrets_helper.js

@@ -0,0 +1,53 @@
+
+// base64 strings were used to leak the secrets
+export const base64Regex =
+  /^(?:[A-Za-z0-9+/]{4}){5,}(?:|[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)$/;
+
+export function findSecretsInLines(lines, base64Regex) {
+  const secrets = [];
+          
+  for (const line of lines) {
+    if (line == "") {
+      continue;
+    }
+
+    const data = line.split(" ").slice(1).join(" ");
+
+    if (data == undefined) {
+      console.warn("Failed to parse log line: " + line);
+      continue;
+    }
+
+    const match = base64Regex.exec(data);
+    if (!match) {
+        continue;
+    }
+    const secret = match[0];
+
+    // Base64 decode the secret
+    try {
+        const decodedOnce = Buffer.from(secret, "base64").toString();
+
+        const match2 = base64Regex.exec(decodedOnce);
+        if (!match2) {
+            continue;
+        }
+
+        const decoded = Buffer.from(decodedOnce, "base64").toString();
+
+        // json decode it
+        try {
+            const jsonDecoded = JSON.parse("{" + decoded + "}");
+            if (Object.keys(jsonDecoded).length > 0) {
+                secrets.push(jsonDecoded);
+            }
+        } catch (error) {
+            continue;
+        }
+    } catch (error) {
+        continue;
+    }
+  }
+
+  return secrets;
+}

test_find_compromised_secrets.js

@@ -0,0 +1,50 @@
+import assert from "assert";
+import { findSecretsInLines, base64Regex } from "./find_compromised_secrets_helper.js";
+
+function testFindSecretsInLines() {
+  console.log("Running test for findSecretsInLines...");
+
+  // Simulate reading lines from a file
+  const lines = [
+    "2025-03-20T12:01:00Z SW1kcGRHaDFZbDkwYjJ0bGJpSTZleUoyWVd4MVpTSTZJbWRvYzE4d01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREFpTENBaWFYTlRaV055WlhRaU9pQjBjblZsZlFvPQo=",
+    "2025-03-20T12:00:00Z Some log message",
+    "2025-03-20T12:02:00Z Another log message",
+    "",
+  ];
+
+  const data = "AAAAAAAAAAAAAAAA";
+
+  const match = base64Regex.exec(data);
+  
+  assert(match, "Failed to match base64 data");
+
+  // Expected secrets after decoding
+  const expectedSecrets = [
+    {
+        github_token: {
+            isSecret: true,
+            value: 'ghs_000000000000000000000000000000000'
+        }
+    }
+  ];
+
+  // Call the function
+  const secrets = findSecretsInLines(lines, base64Regex);
+
+  // Assert the results
+  assert.deepStrictEqual(
+    secrets,
+    expectedSecrets,
+    "The secrets extracted from the lines do not match the expected output."
+  );
+
+  console.log("Test passed!");
+}
+
+// Run the test
+function main() {
+    console.log("Running tests...");
+    testFindSecretsInLines();
+}
+
+main();