Poisoned Pipeline / Techniques / T0179
Exposed webHook
CI/CD Posture
Exposed WebHook attack in CI/CD posture is a technique where an attacker exploits a publicly accessible or improperly authenticated and authorized WebHook endpoint in a CI/CD setup.
The attacker sends malicious payloads or triggers unauthorized actions through the WebHook, gaining unauthorized access to the CI/CD pipeline or associated resources.
The consequences can include unauthorized access to data, compromise of the CI/CD pipeline, injection of malicious code, or disruption of the software development process.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1790 Limit access to webhooks
- M1791 Use secure communication channels
- M1792 Implement secure WebHook configurations
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process
- D1790 Audit and review WebHook configurations
- D1791 Analyze WebHook payloads and activity
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.