Listen to this Post
How the CVE Works
The vulnerability occurs in the GitHub Action `RageAgainstThePixel/setup-steamcmd` where the post-job execution logs inadvertently expose sensitive authentication tokens stored in config/config.vdf. This file contains Steam session tokens that grant full account access. Additionally, `userdata/$user_id$/config/localconfig.vdf` may leak other sensitive data. Attackers can exploit this by extracting tokens from publicly accessible workflow logs, allowing unauthorized access to linked Steam accounts. The issue primarily affects public repositories, where logs are openly viewable.
DailyCVE Form
Platform: GitHub Actions
Version: <1.3.0
Vulnerability: Token leakage
Severity: High
Date: Jul 19, 2025
Prediction: Patch expected by Jul 25, 2025
What Undercode Say
Check workflow logs for exposed tokens grep -r "config.vdf" ./github/workflows/logs Mitigation command (pre-patch): sed -i '/config.vdf/d' post-job-output.log
How Exploit
1. Access public repo workflow logs.
2. Search for `config.vdf` in logs.
3. Extract Steam auth token.
4. Use token to hijack account.
Protection from this CVE
- Upgrade to v1.3.0+.
- Restrict workflow log visibility.
- Manually redact sensitive outputs.
Impact
- Full Steam account compromise.
- Sensitive data exposure.
- Public repos at highest risk.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
