GitLab project job token authorized to access other projects

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_71
Category	Pipeline Based Access Controls
Severity	LOW

Impact

GitLab pipeline jobs are assigned with a token that enables authenticating to specific GitLab API endpoints. https://docs.gitlab.com/ee/ci/jobs/ci_job_token The token is assigned with the same permissions as the user who triggered the pipeline job. The token scope can be limited to the current project only, or to be authorized with access to any private project as the triggering user account. An unlimited token can allow attackers compromising the pipeline job to misuse the permissions granted by the token scope to expand their attack surface by executing further attacks against additional projects.

Recommended Solution - Buildtime

Limit pipeline job token scope:

1. Browse to the project Settings.
2. Under CI/CD, expand Token Access and enable the Limit CI_JOB_TOKEN access setting.