Overprivileged CI/CD Runners

CI/CD Posture Container Security

A container/runner agent privilege escalation attack is a security threat where an attacker exploits vulnerabilities in a container/runner agent to gain elevated privileges or access to sensitive resources they are not authorized to have.
Attackers may exploit software vulnerabilities or weaknesses in container security controls to gain access to privileged resources, execute arbitrary code, or escape the container/runner agent and gain access to the host system.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below. DEF CON 32: Grand Theft Actions, self-hosted runners (Khan/Stawinski).

Mitigations

M1320 Implement least privilege principle for containers
M1321 Container or runner hardening
M1322 Container or runner agent runtime security
M1451 Use network segmentation
M1732 Implement code scanning for security risks

Detections

D1261 Implement penetration testing
D1262 Implement vulnerability assessment
D1510 Implement Intrusion Detection System and anti-malware
D1520 Implement endpoint detection and response system
D1590 Implement continuous monitoring and logging of the CI/CD process

Overprivileged CI/CD Runners

Where this idea came from

Mitigations

Detections

Observed in incidents (3)

References