Harvesting sensitive information from files

CI/CD Posture Infrastructure as code

This attack involves searching for files within the CI/CD system that may contain sensitive information such as credentials, API keys, or other access tokens.
These files can include configuration files, scripts, and other files that are used as part of the build and deployment process.
Attackers can use various techniques to locate these files, including directory traversal attacks, file inclusion vulnerabilities, or simply guessing common file names or paths.
Once the attacker has located a file containing sensitive information, they can extract the credentials and use them to gain unauthorized access to the targeted system or application.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below.

https://www.synacktiv.com/en/publications/cicd-secrets-extraction-tips-and-tricks.html

Mitigations

M1120 Store credentials in vault
M1550 Implement strict access control for clouds
M1860 Implement strong authentication mechanisms
M1861 Implement strong authorization mechanisms

Detections

D1260 Implement regular security audit and review
D1510 Implement Intrusion Detection System and anti-malware
D1590 Implement continuous monitoring and logging of the CI/CD process

Observed in incidents (110)

References

https://www.synacktiv.com/en/publications/cicd-secrets-extraction-tips-and-tricks.html