Poisoned Pipeline / Techniques / T0173
Auto merge rules in SCM
Auto merge rules in SCM (Source Code Management) are rules that determine how code changes should be merged automatically into a main code repository or branch.
While auto merge rules in SCM can help to streamline the code review and merge process, there are several security risks to consider, including:
1. Malicious code injection: Auto merge rules may allow malicious code changes to be merged into the code repository, compromising the security of the system.
2. Vulnerability propagation: Automatic merges can propagate security vulnerabilities to the main code repository or branch, allowing attackers to exploit these vulnerabilities to gain unauthorized access to the system.
3. Human error: Auto merge rules can lead to errors in the code repository, such as overwriting critical code or merging code that has not been properly reviewed.
4. Compliance violations: Auto merge rules can violate compliance requirements, such as failing to properly audit code changes or not properly segregating code changes between different teams.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1730 Implement code reviews
- M1731 Implement verification of signed commits
- M1732 Implement code scanning for security risks
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
Detections
- D1262 Implement vulnerability assessment
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1510 Implement Intrusion Detection System and anti-malware