Organization webhook SSL verification is disabled

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_30
Category	Data Protection
Severity	LOW

Impact

SSL Verification is disabled for an organization webhook, which instructs GitHub to not verify the identity of the remote server. The lack of verification can enable attackers to perform a Man In The Middle attack, and to expose the transmitted data.

Recommended Solution - Buildtime

To enable SSL Verification for a webhook:

1. Browse to the organization Settings.
2. Under Webhooks, select the relevant webhook.
3. Check the Enable SSL verification setting.