Project webhook SSL verification disabled

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_72
Category	Data Protection
Severity	LOW

Impact

SSL Verification is disabled for a project webhook, which instructs GitLab to not verify the identity of the remote server. The lack of verification enables attackers to perform a Man In The Middle attack, and to expose the transmitted data.

Recommended Solution - Buildtime

Enable SSL Verification for the webhook:

1. Browse to the project Settings.
2. Under Webhooks, select the relevant webhook, and select Edit.
3. Check the Enable SSL verification setting.