CI/CD: Security Risks in Pipelines

CI/CD — Continuous Integration and Continuous Delivery — refers to the automated pipeline that builds, tests, and deploys software from source code to production. CI/CD pipelines are a high-value target because they operate with elevated privileges across repositories, registries, cloud environments, and production systems. A compromised pipeline can silently inject malicious code into every artifact it produces. Security risks in CI/CD span multiple layers: hardcoded secrets in pipeline configuration files, insecure third-party actions or plugins, misconfigured pipeline triggers that allow untrusted contributors to execute arbitrary code, and overly permissive service account tokens. The SolarWinds and Codecov incidents illustrated how pipeline compromise can propagate across an entire software supply chain. Understanding the attack surface of a CI/CD system requires mapping every component: source control webhooks, build runners, artifact registries, deployment credentials, and environment variable stores. Each is a potential entry point for an attacker seeking persistent access to production infrastructure.

Detecting CI/CD attacks from a Blue Team perspective requires visibility across version control systems, runner infrastructure, and secrets management platforms. On GitHub Actions or GitLab CI, monitor for unexpected workflow file modifications — especially additions of new steps that exfiltrate environment variables or execute curl/wget commands against external hosts. Audit logs from your CI provider should capture pipeline trigger events, actor identities, and runner IP addresses. Alert on pipelines triggered by external pull requests that access protected secrets or environment scopes. On self-hosted runners, forward system logs to your SIEM and monitor for unusual process trees spawned by the runner agent (e.g., runner process spawning bash with base64-encoded commands). Watch for secrets scanning alerts from tools like GitLeaks, truffleHog, or native GitHub secret scanning. In cloud environments, correlate CI/CD service account activity in CloudTrail or Azure Monitor — a build job performing IAM enumeration or lateral movement is a strong indicator of compromise. Establish baselines for artifact push frequency to detect unexpected registry writes.

Red Team operators target CI/CD pipelines to achieve code execution in privileged build environments and to harvest credentials that grant access to production systems. A common technique is pipeline injection: submitting a pull request that modifies a workflow file to print environment variables containing API keys or cloud credentials. On self-hosted runners, attackers exploit the persistence of the runner process to plant backdoors that survive across jobs. Dependency confusion attacks abuse package manager resolution order — publishing a public package with the same name as an internal private dependency causes the build system to fetch and execute attacker-controlled code. For hardening, enforce branch protection rules so workflow files cannot be modified without review. Pin all third-party actions and dependencies to a specific commit SHA rather than a mutable tag. Use short-lived, scoped credentials (OIDC tokens) instead of long-lived secrets stored as environment variables. Segment self-hosted runners by environment — never allow a runner with production access to execute untrusted external code. Regularly rotate all pipeline secrets and audit their effective permissions.