Poisoned Pipeline / Techniques / T0162
Passwords in CI/CD logs
This type of attack involves searching through the logs generated by the CI/CD system for any sensitive information that may have been inadvertently logged, such as passwords, API keys, or other types of credentials.
In a CI/CD system, logs are generated automatically as part of the build and deployment process.
These logs may contain information about the system's configuration, the commands that were executed, and any errors or warnings that were encountered.
In some cases, these logs may also contain sensitive information that was inadvertently included in the command-line arguments, environment variables, or other parts of the system configuration.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1120 Store credentials in vault
- M1300 Implement log sanitization
- M1301 Implement log sanitization
- M1302 Implement strict access controls for logs
- M1550 Implement strict access control for clouds
Detections
- D1300 Implement regular log reviews
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (3)
- Team PCP CI/CD secrets campaign
- tj-actions/changed-files GitHub Action
- Miri writes env secrets into target/ readable from PR caches