CI/CD Attacks
88 items from tupletype/awesome-cicd-attacks ★635
-
GitHub Archive gharchive.org
GitHub's public timeline since 2011, updated every hour.
-
Remove evidence of malicious pull requests on GitHub x.com
Changing account's email to block-listed domain, automatically bans the account.
-
The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2) wiz.io
Vulnerabilities in AI-powered GitHub Actions. Syntactical permission checks that let attackers impersonate trusted apps and Dependabot Deputy Confusion Injection.
-
Millions of Secrets Exposed via Web Application Frontends web.archive.org
Millions of secrets exposed in web app frontends via JavaScript and debug pages.
-
Can you trust ChatGPT's package recommendations? vulcan.io
Exploit generative AI platforms' tendency to generate non-existent coding libraries to execute Dependecy Confusion.
-
WordPress Plugin Confusion: How an update can get you pwned vavkamil.cz
Unclaimed WordPress plugins are vulnerable to takeover via the plugin directory.
-
#redteam tip: want to discretely extract credentials from a CI/CD pipeline? twitter.com
Draft pull requests won't alert repository contributors, but will still trigger pipelines.
-
(The) Postman Carries Lots of Secrets trufflesecurity.com
Postman's public API network leaks thousands of secrets due to confusing UI, forks, and insufficient secret scanning.
-
Anyone can Access Deleted and Private Repository Data on GitHub trufflesecurity.com
As long as it's part of a fork network.
-
Trojan Source trojansource.codes
Rather than inserting logical bugs, adversaries can attack the encoding of source code files to inject vulnerabilities.
-
Thousands of npm accounts use email addresses with expired domains therecord.media
Maintainer Email hijacking.
-
Hijacking GitHub runners to compromise the organization synacktiv.com
Registering a GitHub runner with the ubuntu-latest tag grants access to jobs originally designated for GitHub-provisioned runners.
-
Sourcegraph sourcegraph.com
A web-based code search and navigation tool for public repositories.
-
Why npm lockfiles can be a security blindspot for injecting malicious modules snyk.io
Malicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly.
-
Deep dive into Visual Studio Code extension security vulnerabilities snyk.io
VS Code extensions have vulnerabilities (command injection, path traversal, zip slip) that can compromise developer machines.
-
whoAMI: A cloud image name confusion attack securitylabs.datadoghq.com
Dependency Confusion using AWS AMIs.
-
Keeping your GitHub Actions and workflows secure Part 2: Untrusted input securitylab.github.com
GitHub Actions command injection.
-
Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests securitylab.github.com
Combining pull_request_target workflow trigger with an explicit checkout of an untrusted PR may lead to repository compromise.
-
CloudQuarry: Digging for secrets in public AMIs securitycafe.ro
Researchers found 500GB of credentials, private repos, and keys in public AWS AMIs, impacting various industries.
-
Risk Explorer for Software Supply Chains riskexplorer.endorlabs.com
-
Publicly Exposed AWS Document DB Snapshots ramimac.me
Publicly exposed AWS DocumentDB snapshot of Cinemark Brazil revealed millions of customer records.
-
From Self-Hosted GitHub Runner to Self-Hosted Backdoor praetorian.com
Attackers exploit misconfigured runners and weak PAT security to gain persistence, escalate privileges, and move laterally.
-
-
Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows paloaltonetworks.com
GitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts.
-
All the Small Things: Azure CLI Leakage and Problematic Usage Patterns paloaltonetworks.com
Azure CLI leaks secrets to CI/CD logs due to usage patterns.
-
Abusing Repository Webhooks to Access Internal CI/CD Systems at Scale paloaltonetworks.com
Repository webhooks, used to trigger CI/CD pipelines, can be abused to access internal systems.
-
The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree paloaltonetworks.com
A novel GitHub Actions worm exploits the action dependency tree. Attackers compromise an action, then infect dependent actions via branch pushes or tag overwrites, spreading malware recursively.
-
How I hacked into Google's internal corporate assets observationsinsecurity.com
More ways to find dependencies in code for Dependency Confusion.
-
Hidden GitHub Commits and How to Reveal Them neodyme.io
A tool that can reveal deleted GitHub commits that potentially contain sensitive information and are not accessible via the public Git history.
-
10 real-world stories of how we've compromised CI/CD pipelines nccgroup.com
Examples include exploiting S3 misconfigurations, Jenkins plugin flaws, GitLab runner privilege escalations, Kubernetes pod annotation vulnerabilities, and compromised developer laptops.
- next page of items loading…
