Poisoned Pipeline / Techniques / T0135
Vulnerable CICD system
An attacker can target the CI/CD system itself and exploit vulnerabilities in the system, such as insecure configurations or outdated software.
The attacker may also target the build scripts, which could contain secrets and sensitive information, allowing them to gain access to the underlying systems or inject malicious code into the software being built.
Some common vulnerabilities in CI/CD systems include insecure storage of credentials, unsecured APIs, and outdated software components.
Additionally, attackers may take advantage of misconfigured permissions, such as overly permissive access controls that allow them to escalate privileges or access sensitive information.
Where this idea came from
Recorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.
- https://www.paloaltonetworks.com/blog/prisma-cloud/shift-left-ci-cd-security-for-your-software-supply-chain/
- https://owasp.org/www-project-top-10-ci-cd-security-risks/
Mitigations
- M1720 Implement regular patches and updates
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
- M1932 Contract a supplier incident-notification clause with a reporting template and SLA
- M1933 Keep a supplier-specific incident playbook with standing risk and access detail
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (4)
- North Korean actors exploited TeamCity CVE-2023-42793
- SolarWinds
- Railway build-infrastructure access decrypted a subset of customer environment variables
- Webmin 1.890–1.920 build-server backdoor