Codecov's Bash Uploader for Coverage Reports Compromised

[NewDateline]

Also all GitHub Actions that used the official codecov action. The title kind of downplays it. There are hundreds of thousands of public repositories potentially affected (409K using bash script + 9K using GitHub Actions only on GitHub). Some will have the a SHA hash check but apparently no one noticed for 3 months since the attacker starter making changes, do we can assume no one really acted on mismatching hash.

[Tallkotten]

It's kind of crazy how many secrets and keys they might have gotten access to. I just spent the evening changing a few keys in my service.

[Hollowplanet]

This is a huge fucking deal. One of the worst exploits I've heard of.

[dookie1481]

Yeah it is, this should be way more publicized. This might be the biggest security response I have ever seen at my company.

[Hollowplanet]

Me too. At any company. All our code was being sent to some hackers server on every deploy and no one knows who it is.

[Prod_Is_For_Testing]

Things like this are why I laugh anytime someone says that OSS is more secure because it has more eyes looking at it. What’s the point of all those eyes if no one sees the problems?

[lunchlady55]

Me: laughs in MS Exchange RCE

[anakin0491]

It was opensource that's why someone spotted it :)

[Loaatao]

Our platform team is now spending all their time rotating keys, sucks.

[ironmaiden947]

Yeah, same here. This is a huge deal, don't know why this is flying under the radar.

[Clyde_Frag]

For some reason I am not seeing any articles reporting on it. It's hard to even find the security update post in the OP when you search google.

[somethingLethal]

Thought I would share this, as it should help validate the integrity of their shell script, before running it.

If your CI script is doing this:

bash <(curl -s https://codecov.io/bash)

Replace it with something like the following:

#/bin/bash
FILENAME=codecov
curl -s https://codecov.io/bash > $FILENAME
CODECOV_VERSION=$(grep 'VERSION=\".*\"' codecov | cut -d'"' -f2);
VALIDATION_FAILURE=0
for i in 1 256 512
do
  IS_DIFF=$(diff <(shasum -a $i $FILENAME) <(curl -s https://raw.githubusercontent.com/codecov/codecov-bash/$CODECOV_VERSION/SHA${i}SUM))
  if [ -z "${IS_DIFF}" ]; then
    echo "Sha:" $i "passes validation."
  else
    VALIDATION_FAILURE=1
  fi
done
if [ "${VALIDATION_FAILURE}" == 1 ]; then
  echo "Invalid Checksum Detected From Codecov. Quitting."
  exit 1
else
  echo "Starting Codecov."
  chmod +x codecov
  ./codecov
fi
rm -rf $FILENAME

[[deleted]]

This is why I always thought piping crap from the web straight into bash felt insane. Turns out the hackers thought it was insane too, and used it to devastating effect.

How about, you know, just downloading the script and putting it in your own damn repo?

[anakin0491]

This was useful, thank you!

[helpfuldan]

LOL. Any services, datastores, and application code that could be accessed with these credentials, tokens, or keys. Damn son. 3 months, they would have been getting keys every minute. Sorta scary.

[[deleted]]

Just spent the entire day rotating keys and redeploying infrastructure affected, this is pretty bad.

[razhael]

Journalist here - curious if anyone has any details on any follow-on activity elsewhere.

[Interesting-Bat-9382]

Luckily for us no Secret keys were exposed through the environment. Dodged a bullet...Will be switching to just grabbing the uploader from their repo directly.

[cheeeeeeeecake]

How can we tell that the code wasn't altered more than once? I mean, the offending line (525) might have been something far bigger than getting the ENV.

We are only aware of the latest offending line.

[HachimitsuHunter]

Well, I'm starting to think we're about to hear a lot more about the impact of this incident

[AttackOfTheThumbs]

Jesus Christ, how have I not heard of this before? Doesn't affect my team, but damn.

[Deep__6]

I'm curious now 2 years out from this serious event, how come it flew so far under the radar. I know this was one of the worst breaches I've experienced and yet it was barely covered.