5 ms·

From TFA: > A surprising number of websites still expose their .git directories to the public. When scanning for such exposures on a target, I noticed that the

by kolme 2y ago

From TFA: > A surprising number of websites still expose their .git directories to the public. When scanning for such exposures on a target, I noticed that the .git folder was publicly accessible. [...] > With access to .git/config, I found credentials, which opened the door to further exploitation. I could just clone the entire repository using the URL found inside the config file. The URL with credentials was found in the `.git/config` file, defined in the [remote "origin"] section. This is the way they won full access to the repo.

Concept5116 2y ago
I don't see how this is specific to "exploiting CI / CD Pipelines" when he's really just exploiting someone encoding their github username AND password credentials (unorthodox af) into the url for remote.
- kolme 2y ago
  Yes, that first part was not. But the article continues like this: - they use that credentials to make a commit adding malicious code to the CI pipeline - The rouge pipeline job adds their public SSH key to the `.allowed_keys` file in the production server As the pipeline is run automatically on push, they get ssh access to the remote server. That is the "CI / CD Pipelines" bit. That being said, it's a bit underwhelming, because given the title I though they were going to exploit a bug in the CI/CD software itself. I don't know if I'd call that "exploiting" CI/CD software.
- threecheese 2y ago
  Because 1) the .git directory was deployed with the app code (the exploit vector), and 2) the deployment pipeline automatically integrated and pushed the attacker’s commit to a production system (completing the exploit), I’d say that claim is accurate. These are both defects in the thing the attacker claims to have exploited. It sure wasn’t a good decision to use git-config to store creds for CI though! I wonder if OP found a developer’s old cached creds in the history that weren’t used anymore but happened to still be valid?

by kolme 2y ago

Concept5116 2y ago

I don't see how this is specific to "exploiting CI / CD Pipelines" when he's really just exploiting someone encoding their github username AND password credentials (unorthodox af) into the url for remote.

kolme 2y ago
Yes, that first part was not. But the article continues like this: - they use that credentials to make a commit adding malicious code to the CI pipeline - The rouge pipeline job adds their public SSH key to the `.allowed_keys` file in the production server As the pipeline is run automatically on push, they get ssh access to the remote server. That is the "CI / CD Pipelines" bit. That being said, it's a bit underwhelming, because given the title I though they were going to exploit a bug in the CI/CD software itself. I don't know if I'd call that "exploiting" CI/CD software.
threecheese 2y ago
Because 1) the .git directory was deployed with the app code (the exploit vector), and 2) the deployment pipeline automatically integrated and pushed the attacker’s commit to a production system (completing the exploit), I’d say that claim is accurate. These are both defects in the thing the attacker claims to have exploited. It sure wasn’t a good decision to use git-config to store creds for CI though! I wonder if OP found a developer’s old cached creds in the history that weren’t used anymore but happened to still be valid?