CI/CD Attacks
88 items from tupletype/awesome-cicd-attacks ★635
-
AWS Targeted by a Package Backfill Attack mend.io
Scan commit history for internal packages to execute dependency confusion.
-
PPE — Poisoned Pipeline Execution medium.com
Poisoned Pipeline Execution (PPE) lets attackers run malicious code in a CI/CD system without direct access.
-
Malicious code analysis: Abusing SAST (mis)configurations to hack CI systems medium.com
Misconfigured SAST tools can be exploited to execute malicious code on CI systems, allowing attackers to steal credentials or deploy malicious artifacts.
-
Bypassing required reviews using GitHub Actions medium.com
GitHub Actions can bypass required reviews, allowing malicious code pushes to protected branches.
-
Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies medium.com
Researchers uploaded malicious packages with internal company names, gaining access to Apple, Microsoft, and others due to dependency confusion.
-
Zuckerpunch - Abusing Self Hosted GitHub Runners at Facebook marcyoung.us
Hide commits in a GitHub PR.
-
How to completely own an airline in 3 easy steps maia.crimew.gay
Misconfigured CI system accessible from the internet.
-
Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline legitsecurity.com
GitHub Actions workflow_run PE.
-
How We Hacked a Software Supply Chain for $50K landh.tech
Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.
-
How a Single Vulnerability Can Bring Down the JavaScript Ecosystem landh.tech
Cache poisoning attack on the NPM registry rendering packages unavailable.
-
Leaking Secrets From GitHub Actions: Reading Files And Environment Variables, Intercepting Network/Process… karimrahal.com
Leaking secrets from vulnerable GitHub Actions workflows is possible via several methods: reading files/environment variables, intercepting communication, and dumping runner memory.
-
Fixing typos and breaching microsoft's perimeter johnstawinski.com
Bypass GitHub workflow approval requirement by becoming a contributor.
-
Playing with Fire – How We Executed a Critical Supply Chain Attack on PyTorch johnstawinski.com
Researchers exploited a critical PyTorch vulnerability via a malicious pull request to execute code on self-hosted runners.
-
Forging signed commits on GitHub iter.ca
A bug in GitHub's API allowed forging signed commits. By exploiting a regex flaw in an internal Codespaces API endpoint, an attacker could create commits signed by any user, despite GitHub's web flow signature.
-
Grep.app grep.app
Search GitHub using regex.
-
Security alert: social engineering campaign targets technology industry employees github.blog
Phishing GitHub users to download and execute repositories.
-
GHTorrent Project ghtorrent-downloads.ewi.tudelft.nl
A queryable offline mirror of the GitHub API data. Tutorial.
-
Dependency Confusions in Docker and remote pwning of your infra errno.fr
Docker dependency confusion occurs when a misconfigured Docker mirror pulls malicious public images instead of private ones.
-
Beyond S3: Exposed Resources on AWS duo.com
Public EBS, RDS, AMI and Elasticsearch clusters exposed to the internet.
-
Hacking GitHub AWS integrations again dagrz.com
Attacking misconfigured pipelines that use OIDC.
-
How We Discovered Vulnerabilities in CI/CD Pipelines of Popular Open-Source Projects cycode.com
Extracting all repository and organization secrets in GitHub Actions.
-
Holes in Your Bitbucket: Why Your CI/CD Pipeline Is Leaking Secrets cloud.google.com
Bitbucket Secured Variables leak secrets via artifact objects; recommendations include using dedicated secrets managers and code scanning.
-
StarJacking – Making Your New Open Source Package Popular in a Snap checkmarx.com
StarJacking is a technique where attackers make malicious open-source packages appear popular.
-
Working as unexpected chainguard.dev
Creating a GitHub branch that matches a branch protection rule pattern with a workflow file that triggers on push to gain access to environment secrets.
-
What the fork? Imposter commits in GitHub Actions and CI/CD chainguard.dev
GitHub Actions vulnerability allows forked commits to bypass workflow security settings.
-
Understanding typosquatting methods - for a secure supply chain bytesafe.dev
Typosquatting involves publishing malicious packages with names similar to legitimate ones, exploiting typos to inject malicious code.
-
Erosion of Trust: Unmasking Supply Chain Vulnerabilities in the Terraform Registry boostsecurity.io
Terraform modules are not protected by the Dependency Lock File, consequently, a seemingly harmless module could potentially introduce malicious code.
-
The massive bug at the heart of the npm ecosystem blog.vlt.sh
NPM Manifest Confusion.
-
Token-Spray blog.projectdiscovery.io
Automate token validation using Nuclei.
-
Hacking Terraform State for Privilege Escalation blog.plerion.com
Modifying a Terraform state file allows attackers to delete infrastructure or execute code via custom providers.
-
Introducing MavenGate: a supply chain attack method for Java and Android applications blog.oversecured.com
Many public and popular libraries that have long been abandoned are still being used in huge projects. Access to projects can be hijacked through domain name purchases.
-
Thousands of images on Docker Hub leak auth secrets, private keys bleepingcomputer.com
Researchers found thousands of Docker Hub images leaking private keys and API secrets.
-
Gitloker attacks abuse GitHub notifications to push malicious OAuth apps bleepingcomputer.com
Attackers use fake GitHub notifications to trick users into authorizing malicious OAuth apps that steal repo access.
-
GitHub comments abused to push malware via Microsoft repo URLs bleepingcomputer.com
Hidden GitHub comment link.
-
Employee Personal GitHub Repos Expose Internal Azure and Red Hat Secrets aquasec.com
Employee's personal GitHub repos expose internal Azure & Red Hat secrets.
-
GitHub Dataset Research Reveals Millions Potentially Vulnerable to RepoJacking aquasec.com
Millions of GitHub repos are vulnerable to RepoJacking due to org renames, leading to potential code execution.
-
Can You Trust Your VSCode Extensions? aquasec.com
Impersonate popular VSCode extensions and trick unknowing developers into downloading them.
-
Fortune 500 at Risk: 250M Artifacts Exposed via Misconfigured Registries aquasec.com
Misconfigured public registries with software artifacts containing sensitive proprietary code and secrets.
-
Invisible Ghost: Alarming Vulnerability in GitHub Copilot apexhq.ai
Using hidden Unicode characters to manipulate GitHub Copilot's suggestions.
-
The Monsters in Your Build Cache – GitHub Actions Cache Poisoning adnanthekhan.com
Allows attackers to compromise workflows even with limited permissions by exploiting vulnerabilities or dependency flaws, attackers steal cache tokens, fill the cache to force evictions, and replace legitimate entries with malicious code.
-
One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images adnanthekhan.com
A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.
