Attacking CI/CD by Reza (DevSecops Giudes), 2025

In CI/CD (Continuous Integration/Continuous Deployment) environments, several methods and attacks can compromise security. Code Injection involves injecting malicious code into the build pipeline, exploiting vulnerabilities in the build system or dependencies, potentially leading to the execution of unauthorized commands or access to sensitive data. Dependency Attacks target vulnerabilities in third-party libraries or dependencies used in the CI/CD pipeline, exploiting them to introduce malicious code or cause failures. Artifact Tampering manipulates the build artifacts (e.g., binaries, containers) to include malicious payloads or vulnerabilities, which can be deployed to production systems. Pipeline Hijacking involves gaining unauthorized access to the CI/CD environment to alter build configurations, steal secrets, or inject malicious code into the pipeline.

Credential Exposure occurs when sensitive credentials or secrets (e.g., API keys, tokens) are hardcoded or improperly managed, making them accessible to attackers who can use them to gain unauthorized access. Phishing and Social Engineering tactics target developers or CI/CD administrators to trick them into revealing access credentials or executing malicious commands. Denial of Service (DoS) attacks can overwhelm CI/CD systems, disrupting the build and deployment processes. Misconfiguration of CI/CD tools and environments can inadvertently expose systems or data, leading to potential security breaches. Each of these methods requires vigilant security practices, including secure coding, regular dependency audits, and robust access controls, to mitigate risks in CI/CD workflows.

• CI Debug Enabled;
• Default permissions used on risky events;
• Github Action from Unverified Creator used;
• If condition always evaluates to true;
• Injection with Arbitrary External Contributor Input;
• Job uses all secrets;
• Unverified Script Execution;
• Arbitrary Code Execution from Untrusted Code Changes;
• Unpinnable CI component used;
• Pull Request Runs on Self-Hosted GitHub Actions Runner;
• Mitigation Strategies;
• Example GitHub Actions Workflow;
• RCE via Git Clone;
• Resources

See also:
📌 Attacking and Securing CI/CD Pipeline by Hiroki Suezawa, October 20, 2021

#SecDevOps