A supply-chain attack compromised virtually all versions of the Trivy vulnerability scanner via stolen credentials used to force-push malicious dependencies to its GitHub repository tags. The attack vector involved overriding git safety mechanisms to replace legitimate tags, potentially compromising any pipeline using the affected scanner. Organizations using Trivy should assume their pipelines are compromised and urgently review their security posture.
Hackers have compromised virtually all versions of Aqua Security’s widely used Trivy vulnerability scanner in an ongoing supply chain attack that could have wide-ranging consequences for developers and the organizations that use them. Trivy maintainer Itay Shakury confirmed the compromise on Friday, following rumors and a thread , since deleted by the attackers, discussing the incident. The attack began in the early hours of Thursday. When it was done, the threat actor had used stolen credentials to force-push all but one of the trivy-action tags and seven setup-trivy tags to use malicious dependencies. Assume your pipelines are compromised A forced push is a git command that overrides a default safety mechanism that protects against overwriting existing commits. Trivy is a vulnerability scanner that developers use to detect vulnerabilities and inadvertently hardcoded authentication secrets in pipelines for developing and deploying software updates. The scanner has 33,200 stars on GitHub, a high rating that indicates it’s used widely. Read full article Comments