What it means for teams

The systems that build and ship software are production systems in their own right. An unpatched, self-managed CI server or an artifact repository open to the network is a direct route to the code and credentials it holds.

How to prevent it

  • Inventory each CI/CD system and its version with an owner, and patch, restrict or retire components with known vulnerabilities.
  • Limit network access to each system to the hosts and users that need it.
  • Review security-relevant configuration on a schedule rather than once.
  • Grant access to execution nodes on least privilege, and treat debug access to a build node as access to its secrets.

Guides on this site

Also covers this · Guide

Harden GitHub Actions against workflow and supply-chain attacks

Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.

Practice

Gaps on this site

The site covers hosted GitHub Actions settings and its runners. No guide here hardens a self-managed CI server such as Jenkins or a self-managed GitLab instance, or an artifact repository.

References

  1. CICD-SEC-7 Insecure System Configuration (OWASP)

List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.