Poisoned Pipeline / Techniques / T0158
Vulnerable CI/CD template
Vulnerable CI/CD template attack is an attack technique that targets the templates used in the CI/CD pipeline configuration.
These templates are used to automate the process of building, testing, and deploying applications.
Attackers can modify these templates to include malicious code or configuration that can result in unauthorized access or data theft.
In this attack, the attacker typically searches for templates that have known vulnerabilities or weak configurations.
Once identified, the attacker can modify the template to include their malicious code or configuration.
The attacker then waits for the target to use the modified template in their CI/CD pipeline, which can result in the attacker gaining access to sensitive data or systems.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1580 Restrict access to templates
- M1581 Template validation
- M1720 Implement regular patches and updates
- M1732 Implement code scanning for security risks
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1580 Regularly review and audit templates
- D1590 Implement continuous monitoring and logging of the CI/CD process