Listen to this Post
How the CVE Works
The `steam-workshop-deploy` GitHub Action fails to exclude the `.git` directory during deployment packaging, leading to unintentional leakage of repository metadata and embedded credentials (e.g., GitHub PATs in .git/config). Game modding workflows often package from the project root, where `.git` resides, increasing exposure risk. Self-hosted runners or custom `.git` directories with long-lived tokens exacerbate severity. The GHSA-7j9v-72w9-ww6w example demonstrates real-world impact, where sensitive tokens or private repo data may be distributed in deployment artifacts.
DailyCVE Form
Platform: GitHub Actions
Version: steam-workshop-deploy
Vulnerability: Data Exposure
Severity: Critical
Date: 2023-05-15
Prediction: Patch by 2023-06-20
What Undercode Say
Check for .git in artifacts
find ./deploy -name ".git" -type d
Revoke exposed PATs
gh api -X DELETE /repos/{owner}/{repo}/actions/secrets/{secret_name}
Manual .git exclusion
rsync -av --exclude='.git' src/ deploy/
Exploit
- Attacker scans public mod deployments for `.git` directories.
2. Extracts embedded PATs or private repo URLs.
- Uses tokens for unauthorized repo access or CI abuse.
Protection
- Manually exclude
.git:with: exclude: ".git/"
- Use `deployignore` file.
- Rotate all embedded tokens.
Impact
- Critical (9.0+): Permanent PATs, private code leaks.
- Medium (5.0-8.9): Short-lived tokens exposed.
- Low (0.0-4.9): Public metadata only.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
