PT-2025-31593 · Github Actions · Rageagainstthepixel/Setup-Steamcmd

Published

2025-07-21

·

Updated

2025-07-21

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

Log output includes authentication token that provides full account access

Details

The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves authentication tokes for the associated steam accounts publicly available. Additionally, userdata/$user id$/config/localconfig.vdf contains potentially sensitive information which should not be included in public logs.

PoC

Use the following workflow step
steps:
   - name: Setup SteamCMD
    uses: buildalon/setup-steamcmd@v1.0.4

   - name: Sign into steam
    shell: bash
    run: |
     steamcmd +login ${{ secrets.WORKSHOP USERNAME }} ${{ secrets.WORKSHOP PASSWORD }} +quit

Impact

Anyone who has used this workflow action with a steam account is affected and has had valid authentication tokens leaked in the job logs. This is particularly bad for public repositories, as anyone with a GitHub account can access the logs and view the token.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

GHSA-C5QX-P38X-QF5W

Affected Products

Rageagainstthepixel/Setup-Steamcmd