Trivy Vulnerability Scanner - Supply Chain Attack Exposed

What Happened

In late February, Aqua Security's Trivy, an open-source vulnerability scanner, fell victim to a supply chain attack. The attack was first disclosed on March 1, when maintainers revealed that the GitHub repository had been compromised through a GitHub Actions workflow issue. Malicious versions of the application were published, including compromised VS Code extensions on the Open VSIX marketplace. This incident is part of a broader automated attack campaign targeting multiple open-source repositories.

The attackers managed to delete some legitimate releases and inject malicious code into the Trivy ecosystem. This included a malicious release of Trivy (version v0.69.4) that was distributed across various channels, including GitHub Container Registry and Docker Hub. The attack leveraged compromised credentials, allowing the threat actors to push malicious updates that would infect users' systems with an information stealer.

Who's Affected

The impact of this attack primarily affects users of the Trivy scanner, particularly those who downloaded the compromised version v0.69.4. Aqua Security confirmed that none of its commercial products using Trivy were affected, as they follow a controlled integration process. However, users who executed the malicious version need to act swiftly to mitigate potential damage. The maintainers have urged users to check for any installations of the compromised version and to look for suspicious repositories in their GitHub organizations.

What Data Was Exposed

The malicious version of Trivy was designed to extract sensitive information from users' systems. Specifically, it targeted the Runner.Worker process memory to dump secrets and credentials. The stolen data was then encrypted and sent to a remote server. If the exfiltration failed, the malware created a public GitHub repository to upload the data. This means that any secrets or tokens used in CI/CD pipelines could be at risk, potentially leading to further compromises.

What You Should Do

Aqua Security recommends immediate action for users who may have used the compromised versions of Trivy, trivy-action, or setup-trivy. Users should:

• Rotate all credentials, tokens, and secrets used in their environments.
• Remove any affected artifacts from their systems, especially if they executed Trivy v0.69.4.
• Monitor for repositories named tpcp-docs in their GitHub organizations, as this may indicate that the fallback exfiltration mechanism was triggered.

Additionally, Aqua continues to investigate the ongoing threat, as suspicious activity was identified as recently as March 22. Users should stay vigilant and keep their systems updated with the latest secure versions of Trivy.