Project service hook SSL verification is disabled

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_182
Category	Data Protection
Severity	LOW

Impact

SSL Verification is disabled for a project service hook, which instructs Azure Repos to not verify the identity of the remote server. The lack of verification enables attackers to perform a Man In The Middle attack, and to expose the transmitted data.

Recommended Solution - Buildtime

To enable SSL Verification for a service hook:

1. In Azure Repos, browse to Project Settings.
2. Under Service hooks, select the relevant webhook.
3. Uncheck the Accept untrusted SSL certificates setting.