CVE-2025-47775: Bullfrog Privilege Escalation Vulnerability

CVE-2025-47775 Overview

CVE-2025-47775 affects Bullfrog, a GitHub Action designed to block unauthorized outbound traffic in GitHub workflows. The flaw allows attackers to bypass the egress sandbox by routing DNS queries over TCP, enabling data exfiltration from workflow runners. Versions prior to 0.8.4 fail to filter TCP-based DNS traffic, breaking the intended blocking behavior. The maintainers released v0.8.4 to address the issue.

The vulnerability is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data] and is documented in GitHub Security Advisory GHSA-m32f-fjw2-37v3.

Critical Impact
Attackers can bypass Bullfrog's egress filtering and exfiltrate secrets, source code, or build artifacts from GitHub Actions workflows using TCP-based DNS tunneling.

Affected Products

Bullfrogsec Bullfrog GitHub Action prior to version 0.8.4
GitHub workflows relying on Bullfrog for outbound traffic restriction
CI/CD pipelines using Bullfrog as a sandboxing control

Discovery Timeline

2025-05-14 - CVE-2025-47775 published to NVD
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-47775

Vulnerability Analysis

Bullfrog operates as a GitHub Action that enforces egress filtering on workflow runners by intercepting and inspecting outbound network traffic. The action is intended to prevent unauthorized data exfiltration and command-and-control communication from compromised builds.

The vulnerability stems from incomplete protocol coverage in the filtering logic. When DNS queries are issued over TCP rather than the default UDP transport, Bullfrog fails to apply its blocking rules. Attackers who gain code execution inside a workflow can route DNS traffic over TCP to bypass the sandbox and exfiltrate data to attacker-controlled name servers.

This class of bypass undermines the core security guarantee of the tool. Workflows that depend on Bullfrog to contain malicious dependencies or compromised actions remain exposed to DNS tunneling techniques until upgraded.

Root Cause

The root cause is a missing enforcement path for TCP DNS traffic in the egress filtering implementation. The filtering rules covered UDP DNS but did not extend equivalent controls to TCP port 53, leaving an unmonitored channel for outbound queries.

Attack Vector

Exploitation requires the attacker to execute code within a Bullfrog-protected workflow, typically through a malicious dependency, compromised action, or untrusted pull request. Once executing, the attacker issues DNS queries over TCP to an attacker-controlled authoritative server. Sensitive data is encoded into subdomain labels and transmitted as part of DNS lookups, evading the egress block.

No authentication or user interaction with the GitHub workflow is required beyond triggering the vulnerable build. See the patch commit for the corrective changes.

Detection Methods for CVE-2025-47775

Indicators of Compromise

Outbound TCP connections to port 53 originating from GitHub Actions runners
High-volume or unusually long DNS queries with encoded subdomain labels
DNS lookups targeting domains not present in the workflow's expected allowlist
Bullfrog action versions earlier than 0.8.4 referenced in workflow YAML files

Detection Strategies

Audit repository workflow definitions for bullfrogsec/bullfrog pinned to versions below 0.8.4
Inspect runner egress logs for TCP/53 traffic, which is uncommon in normal CI workloads
Correlate DNS query patterns against known tunneling signatures such as long base32 or base64 labels

Monitoring Recommendations

Enable network flow logging on self-hosted runners to capture protocol and destination metadata
Forward DNS resolver logs to a centralized analytics platform for anomaly detection
Set alerts on outbound connections from CI/CD infrastructure to non-allowlisted resolvers

How to Mitigate CVE-2025-47775

Immediate Actions Required

Upgrade the Bullfrog GitHub Action to version 0.8.4 or later in all workflow files
Rotate any secrets accessible to workflows that ran with affected Bullfrog versions
Review recent workflow runs for evidence of unexpected TCP/53 outbound traffic

Patch Information

The issue is fixed in Bullfrog v0.8.4. The corrective changes are tracked in the GitHub commit ae7744a and released through GitHub Release v0.8.4. Pin workflows to the patched version or later to restore egress enforcement.

Workarounds

Block outbound TCP port 53 at the network or runner firewall level for CI/CD environments
Restrict workflows to a minimal DNS allowlist enforced outside the Bullfrog action
Use self-hosted runners with strict egress controls until upgrades are completed

bash

# Configuration example: update Bullfrog reference in .github/workflows/*.yml
- name: Enable egress filtering
  uses: bullfrogsec/bullfrog@v0.8.4
  with:
    egress-policy: block