InfoSecBulletin Cybersecurity for mankind
The CTO of Razz Security, Mukesh, recently exploited CI/CD pipelines to gain full server access which has its origins in the presence of an exposed .git directory on a publicly available web server. For this flaw, anyone could read and download the entire version control.
It is examined that, this particular configuration file contained sensitive user credentials, and as a result of this, it dramatically escalates the exploit chain further. Bad actor can potentially use these credentials to perform a full server takeover cloning the entire Git repository.
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
CVE-2023-39780
Botnet hacks thousands of ASUS routers
Bangladesh Bank instructed using AI to prevent online gambling
251 Amazon-Hosted IPs Used in Exploit Scan for ColdFusion, Struts, and Elasticsearch
This allows an attacker to take full control of source code, it highlights the importance of properly securing version control systems in web environments. Razz security report reads, To gain unauthorized access to a production server an attacker exploited Bitbucket Pipelines, reads .
While discovering the pipeline configuration file threat actor modified it to include their own SSH (Secure Shell) public key in the server’s authorized_keys file.
The altered pipeline script used the atlassian/ssh-run:0.2.8 pipe to execute commands on the target server (damn.vulnerable.site) as the ‘ubuntu’ user.
This modification allowed the attacker to add their key using the command: “echo ssh-rsa AAAA…snip…sw== >> /home/ubuntu/.ssh/authorized_keys”.
The next pipeline run is triggered by a code push to the master branch, such types of changes allows the attacker to gain SSH access to the server.
With this foothold, bad actor took shell access and full control over the compromised server, while this includes the ability to execute arbitrary commands.
Moreover, they noted a potential privilege escalation vulnerability, and this flaw could lead to root access, further expanding their control over the system.
This exploit chain highlights the dangers of exposing sensitive directories, like the .git folder, to the public and abusing CI/CD pipelines.
Mitigations
Here below we have mentioned all the mitigations:-
Make sure to regularly monitor and review SSH key access.
Remove outdated or unnecessary SSH keys.
Block public access to your .git directory.
