Get the latest tech news
Exploiting CI / CD Pipelines for fun and profit
ction In today’s world of fast-paced development and continuous integration, security vulnerabilities can be easy to overlook. Recently, I discovered a severe exploit chain, starting from a publicly exposed .git directory, which led to a full server takeover.
Recently, I discovered a severe exploit chain, starting from a publicly exposed.git directory, which led to a full server takeover. Key Findings: The pipeline configuration file revealed that SSH was being used to log into the production server as part of the automated deployment process. It serves as a reminder to developers and sysadmins to audit their code repositories, deployment pipelines and server configuration regularly to prevent such attacks.
Or read this on Hacker News