InfoSecBulletin Cybersecurity for mankind
The CTO of Razz Security, Mukesh, recently exploited CI/CD pipelines to gain full server access which has its origins in the presence of an exposed .git directory on a publicly available web server. For this flaw, anyone could read and download the entire version control.
It is examined that, this particular configuration file contained sensitive user credentials, and as a result of this, it dramatically escalates the exploit chain further. Bad actor can potentially use these credentials to perform a full server takeover cloning the entire Git repository.
First couple “Rosie” to conceive using AI tech “STAR” successfully
Scattered Spider Actively Attacking Aviation and Transportation: FBI
Russia’s restrictions on Cloudflare making websites inaccessible
61 million Verizon records allegedly posted online for sale
Cyber Expert ‘Rene Joshilda’ Arrested for Bomb Hoaxes
Critical RCE Flaws in Cisco ISE and ISE-PIC Allow to Gain Root Access
CISA Warns of FortiOS Hard-Coded Credentials Vulns
5 vendors’ printer totaling 748 models affected: Rapid7
Citrix Released Emergency Patches for Actively Exploited CVE-2025-6543
SonicWall warns of a trojanized NetExtender stealing VPN logins
This allows an attacker to take full control of source code, it highlights the importance of properly securing version control systems in web environments. Razz security report reads, To gain unauthorized access to a production server an attacker exploited Bitbucket Pipelines, reads .
While discovering the pipeline configuration file threat actor modified it to include their own SSH (Secure Shell) public key in the server’s authorized_keys file.
The altered pipeline script used the atlassian/ssh-run:0.2.8 pipe to execute commands on the target server (damn.vulnerable.site) as the ‘ubuntu’ user.
This modification allowed the attacker to add their key using the command: “echo ssh-rsa AAAA…snip…sw== >> /home/ubuntu/.ssh/authorized_keys”.
The next pipeline run is triggered by a code push to the master branch, such types of changes allows the attacker to gain SSH access to the server.
With this foothold, bad actor took shell access and full control over the compromised server, while this includes the ability to execute arbitrary commands.
Moreover, they noted a potential privilege escalation vulnerability, and this flaw could lead to root access, further expanding their control over the system.
This exploit chain highlights the dangers of exposing sensitive directories, like the .git folder, to the public and abusing CI/CD pipelines.
Mitigations
Here below we have mentioned all the mitigations:-
Make sure to regularly monitor and review SSH key access.
Remove outdated or unnecessary SSH keys.
Block public access to your .git directory.
