CI/CD Pipeline Code Injection
Overview
CI/CD pipelines that execute shell commands incorporating untrusted values (branch names, commit messages, PR metadata) are vulnerable to injection. Attackers can create branches or issues with malicious names to execute arbitrary commands in the CI environment, accessing secrets.
Remediation
- Quote all shell variables in CI scripts
- Use CI-specific secret mechanisms instead of environment variable interpolation
- Validate and sanitize branch names and other git metadata before use in scripts