PT-2025-5344 · Github · Codeql Cli+1
Jstawinski
·
Published
2025-01-24
·
Updated
2025-04-10
·
CVE-2025-24362
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
CodeQL Action versions prior to 3.28.3
CodeQL CLI versions prior to 2.20.3
Description
In certain circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain environment variables from the workflow run, including secrets. Users with read access to the repository can access this artifact, potentially exposing secrets. The issue is specific to workflow runs that satisfy conditions such as scanning Java/Kotlin languages, running in a repository with Kotlin source code, and using specific versions of CodeQL Action and CLI. The exposed environment variables may include a valid
GITHUB TOKEN, which has access to the repository and specified permissions. The GITHUB TOKEN is valid until the job completes or 24 hours have elapsed.Recommendations
For CodeQL Action versions prior to 3.28.3, update to version 3.28.3 or later to resolve the issue.
For CodeQL CLI versions prior to 2.20.3, update to version 2.20.3 or later to resolve the issue.
As a temporary workaround, consider disabling debug artifacts in the CodeQL Action to minimize the risk of exposing environment variables.
Restrict access to the repository to minimize the risk of unauthorized access in case the
GITHUB TOKEN is exposed.Exploit
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Codeql Action
Codeql Cli