Project configured for group-wide access using job token

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_238
Category	Pipeline Based Access Controls
Severity	MEDIUM

Impact

GitLab pipeline jobs are assigned a token that enables authentication to specific API endpoints. https://docs.gitlab.com/ee/ci/jobs/ci_job_token The token has the same permissions to access the API as the user who triggered the job. By compromising a third party and achieving code execution in a pipeline, attackers can exploit the permissions granted by the token to expand their attack and potentially compromise any projects accessible by the user that are not specifically restricted by the job token allow list.

Recommended Solution - Buildtime

It is recommended to configure a project to restrict access from other job tokens through an allow list.

To Control access that other projects have to a project by enabling an allow list of approved projects:

1. In GitLab, browse to the Project Settings page.
2. Under CI/CD, expand Token Access and toggle the Allow access to this project with a CI_JOB_TOKEN button ON.
3. To add a project to the allow list, add the project name in the provided field and click Add project.