pentest-cicd

pentest-cicd

CI/CD pipeline attack surface advisory. Assumes repository access within an authorized engagement.

Triggers

• "CI/CD pentest"
• "GitHub Actions vulnerability"
• "GitLab CI test"
• "Jenkins security"
• "workflow injection"
• "OIDC token abuse"
• "supply chain pentest"

Attack Surface Map

Component	Common Vulnerability
Source repo	Secret leak (env, .pem, .key)
Workflow file	Injection via PR title, comment, branch name
Runner	Self-hosted runner takeover
Secret store	Environment variable leak in logs
OIDC trust	Privilege leak to the cloud provider
Action marketplace	Compromised 3rd party action
Artifact	Exfiltrate or tamper with the build artifact
Cache	Cache poisoning (the next build picks it up)

GitHub Actions Specific

Common Injection Pattern

# UNSAFE — ${{ code }} inside PR title -> shell injection
- run: echo "Processing PR: ${{ github.event.pull_request.title }}"

# Attack: PR title = `";rm -rf $HOME ;echo "`
# Resulting command: echo "Processing PR: ";rm -rf $HOME ;echo ""

# SAFE
- run: echo "Processing PR: $TITLE"
  env:
    TITLE: ${{ github.event.pull_request.title }}

pull_request_target Vulnerability

# UNSAFE — secrets reachable via a fork PR
on: pull_request_target
jobs:
  test:
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # runs fork code
      - run: npm install                                  # fork malicious npm script

Detect:

• pull_request_target + checkout head.sha = HIGH risk
• pull_request_target + secret usage = HIGH risk

Self-Hosted Runner Takeover

• Public repo + self-hosted runner: anyone can register job
• Fix: organization-level allowlist, ephemeral runner (single job)

OIDC Trust Misconfig

# AWS role trust policy
{
  "Condition": {
    "StringEquals": {
      "token.actions.githubusercontent.com:sub": "repo:org/repo:*"   # too broad
    }
  }
}