cicd-technique

Goal: Exploit CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins) to achieve code execution in runners, extract pipeline secrets, or backdoor production artifacts.

When this technique applies

• Evaluating a repository for supply chain vulnerabilities.
• Gained access to a repository with write permissions to Pull Requests, Issues, or Wiki.
• Compromised a CI/CD runner container.

The Execution Workflow

1. Runner Context Enumeration

If you achieved execution within a pipeline step (e.g., via Poisoned PR):

• Dump secrets: Run env, search for AWS_ACCESS_KEY_ID, GITHUB_TOKEN, or $NPM_TOKEN.
• Identity: For GitHub, investigate ACTIONS_ID_TOKEN_REQUEST_URL for OIDC (OpenID Connect) trust to AWS/GCP/Azure.