CI/CD Pipeline Poisoning Kit

CI/CD Pipeline Poisoning Kit

Techniques of attack against pipelines of integration continua:

n
• GitHub Actions — Injection via pull_request_target, workflow_run abuse, GITHUB_TOKEN scope escalation, artifact poisoning.
n
• GitLab CI — Variable extraction, shared runner abuse, include directive injection, cache poisoning.
n
• Jenkins — Groovy script console abuse, credential extraction via pipeline, shared library injection.
n
• General — Dependency confusion attacks, build artifact tampering, secret extraction from build logs.
n
• Detection — Scripts for detect if a pipeline es vulnerable a each technique antes of exploit.
n