Poisoned Pipeline / Techniques / T0133
Vulnerable CICD plugins
CI/CD Posture
Vulnerable CI/CD plugins attack technique is an initial access tactic where an attacker exploits a vulnerability in a plugin used by a continuous integration and continuous delivery (CI/CD) pipeline to gain access to the pipeline or the underlying system.
Vulnerable plugins used in the CI/CD pipeline can be exploited by attackers to inject malicious code or to execute arbitrary commands on the target system.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://www.legitsecurity.com/blog/how-to-continuously-detect-vulnerable-jenkins-plugins-to-avoid-a-software-supply-chain-attack
- https://www.jenkins.io/security/plugins/
- https://www.theregister.com/2022/06/30/jenkins_plugins_security_advisories/
Mitigations
- M1330 Implement regular plugin updates
- M1331 Conduct plugin security review
- M1332 Implement least privilege principle for plugins
- M1720 Implement regular patches and updates
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.