Poisoned Pipeline / Techniques / T0182
Bypass review using admin permission
The Bypass Review using admin permission attack technique refers to a defense evasion tactic where an attacker gains administrative access to a CI/CD pipeline and uses that access to bypass security reviews of code changes.
Typically, in a CI/CD pipeline, code changes are subjected to automated and manual reviews before they are deployed.
These reviews help to detect and prevent the introduction of vulnerabilities or malicious code into the production environment.
However, if an attacker is able to gain administrative access to the pipeline, they can bypass these reviews and directly inject malicious code into the final product.
This attack technique can be particularly dangerous because it allows an attacker to bypass critical security controls and deploy malicious code directly to the production environment.
Additionally, since the code is not subject to the normal review process, it may not be detected by traditional security controls.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://docs.gitlab.com/ee/user/permissions.html
- https://www.cidersecurity.io/blog/research/bypassing-required-reviews-using-github-actions/
Mitigations
- M1661 Revoke user permissions
- M1662 Evaluate pipeline execution permissions
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process