From YAML to Root: CI/CD Pipeline Attacks and Countermeasures#

Hugo

• Why: IaC-driven self-service pipelines have widened pipeline access from a few admins to contributors and even external clients — this maps the resulting attack surface for exactly the cloud-native infrastructure the PM's world runs on.
• What: A demonstration that a standard contributor account can be escalated to full CI/CD and infrastructure compromise — RCE via pipeline-file manipulation and Terraform constructs (external data sources, custom providers/modules, provisioners), bypasses of provider/module blacklists and step filters, then cloud-credential theft and pipeline persistence — followed by a defensive playbook (secret handling, runner hardening, integrity checks, pipeline log analysis and IoCs). (from abstract only)
• How: Chaining misconfigurations and legitimate features in Azure DevOps / GitHub Actions with Terraform and Ansible, under realistic enabled protections.
• Where applicable: Organizations running self-service or multi-tenant CI/CD with IaC; broadly applicable to modern pipeline stacks.