Repository webhook SSL verification is disabled

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_39
Category	Data Protection
Severity	LOW

Impact

SSL Verification is disabled for a repository webhook, which instructs GitHub to not verify the identity of the remote server. The lack of verification enables attackers to perform a Man In The Middle attack, and to expose the transmitted data.

Recommended Solution - Buildtime

To enable SSL Verification for a webhook:

1. Browse to the repository settings.
2. Under Webhooks, click the relevant webhook.
3. Check the Enable SSL Verification setting.