Security researchers have demonstrated a new method called Poisoned Pipeline Execution (PPE) that abuses permissions inside Source Code Management (SCM) repositories. Experts claim that the new approach exploit can lead to poisoned pipeline attacks.
Moreover, the researchers noted that the Poisoned Pipeline Execution focuses on utilising CI configuration files stored in pipeline repositories. These files are commonly located with standard formats such as .gitlab-ci[.]yml and Jenkinsfile, which include commands operated by the abuse when pipeline jobs pick code from developer sources.
Therefore, if a malicious threat actor successfully modifies command lists, they may run malicious code in the Continuous Integration.
The Poisoned Pipeline Execution (PPE) attack transmitter needs SCM permissions (user credentials or access tokens) to manipulate CI configuration files or identical content and operational pipeline activity.
A threat actor is mandated to tamper with the files without activating reviews. Also, the pipelines that run unreviewed code are more prone to PPE attacks.
Threat actors can also carry out the Poisoned Pipeline Execution in three different methods:
- The Direct PPE, which involves tampering of CI configuration files.
- The Indirect PPE, wherein malicious code is injected into the files involved in the pipeline indirectly.
- The Public PPE, wherein it targets the repositories that host pipeline configuration files.
Once the attackers accomplish the code execution, they can access confidential information or infiltrate additional hosts.
Some examples detailed by researchers regarding poisoned software updates delivery include the attacks on Kaseya, Codecov, and SolarWinds, which have portrayed the hostility of this threat against any entity.
Applications that do not develop a security-first approach may be prone to Poisoned Pipeline Execution attack threats. Thus, organisations should develop applications in a compressed, purpose-driven, and security-first attitude. If applications follow this suggestion, it will help mitigate the possibility of any flaw making it to production.
