Your CI/CD Pipeline Is Vulnerable, But It's Not Your Fault
Demonstrates a command injection vulnerability in the Bazel GitHub Action that allowed malicious tampering in Google's build pipeline.
Summary
Command Injection in CI/CD Workflows
CI/CD pipelines frequently execute untrusted input within automation runners, creating high-impact attack surfaces. A single vulnerable pipeline component can allow attackers to achieve arbitrary command execution within build environments.
Compromising the Bazel GitHub Action
Research into Google's open-source Bazel project uncovered a command injection vulnerability in its GitHub Actions workflow. Attackers could exploit this flaw to execute unauthorized code during pipeline execution and tamper with repository release artifacts.
Securing Pipeline Runners
Defending CI/CD infrastructure requires strict input sanitization, least-privilege token permissions, and isolation of untrusted pull request triggers to prevent repository compromise.
Related talks
Main Stage·42 min
Aviad Hahami
Reconstructs the multi-stage CI/CD supply chain compromise of the popular tj-actions GitHub Action, detailing secret exfiltration and attacker tradecraft.
Main Stage·44 min
Adnan Khan · John Stawinski
Exploiting insecure defaults in self-hosted GitHub Actions runners to compromise repositories, cloud environments, and internal networks.
Main Stage·40 min
Asi Greenholts
Asi Greenholts demonstrates a proof-of-concept worm propagating through the GitHub Actions ecosystem by compromising interdependent custom actions.