Miri Caching Vulnerability Exposes Secrets in GitHub Actions

Vulnerability Discovery

The Rust Security Response Team discovered that Miri, a Rust tool, stored all environment variables within the `target/` directory. This behavior, when combined with GitHub Actions' caching mechanism, created a potential security vulnerability. Secrets passed as environment variables could be inadvertently cached and subsequently accessed by pull requests (PRs).

How the Exposure Occurred

GitHub Actions allows caching directories between runs, with typical setups permitting main branch CI runs to write to the cache and PRs to only read from it. Rust projects often cache the `target/` directory to speed up CI. Because Miri stored all environment variables in `target/`, any secrets present in the environment during a CI run would be persisted in the cache. Malicious actors could then trigger a PR CI run, read these cached secrets, and potentially cover their tracks by pushing a second commit.

Mitigation and Fix

The immediate fix involves modifying Miri to only preserve `CARGO_*` environment variables (excluding `CARGO_*_TOKEN`) and `OUT_DIR`. This change prevents the broad storage of all environment variables. The Rust Security Response Team also conducted an ecosystem scan, identifying one repository with the issue and seven others that should exercise caution, and has contacted their maintainers.

Affected Users

Users are vulnerable if they run `cargo miri` in CI, and the step executing `cargo miri` has access to secrets as environment variables. This includes secrets passed directly to the step, set in the workflow's `env`, or persisted from a previous step. Users running Miri in their GitHub Actions setups are advised to check their configurations.