OWASP Top 10 CI/CD

Build systems are essential tools in modern software development offering numerous benefits around productivity and maintaining code quality. However they often run with high privileges, fall outside the scope of traditional penetration tests and their logs are rarely reviewed. Combine these factors with heavy use of third-party open source components and libraries in most solutions and this presents some interesting opportunities for attackers and malicious insiders.

Let’s look at some recent incidents that exploited these issues and map some of the vulnerabilities exploited onto the OWASP Top 10 CI/CD:

There are several controls that can be put in place to mitigate or reduce the risk of the above we wanted to call out the following approaches:

• Keep credentials out of repositories and use appropriate secret vault systems that enable secret rotation. CICD-SEC-6 - secrets should never be contained within code bases in plain text. In the CodeCov example if compromised solutions had used a key vault solution an attacker would not have been able to retrieve secrets contained in the repository
• Be conscious of the 3rd party components used and use stable versions in scripts. CICD-SEC-8. Referencing the latest version of a component can ensure you benefit from the latest performance enhancements and features but can open you up to incidents such as ua-parser-js. Most organisations would be safer referencing current version - 1 or 2 versions to ensure stability and reduce likelihood of running malicious code
• Be more aware of what is going on with production systems through better logging and monitoring. CICD-SEC-10. Effective monitoring, alerts and logging can assist with the detection of malware

For those interested in learning more we explore issues contained in CI/CD systems in our App Security training by Kodez at a deep level and look at easy to implement controls and processes that can reduce risk to organizations.

In summary we believe these types of attacks will become more common in future and recommend all development teams review the OWASP Top 10 CI/CD Security Risks.