InfoSecBulletin Cybersecurity for mankind
The CTO of Razz Security, Mukesh, recently exploited CI/CD pipelines to gain full server access which has its origins in the presence of an exposed .git directory on a publicly available web server. For this flaw, anyone could read and download the entire version control.
It is examined that, this particular configuration file contained sensitive user credentials, and as a result of this, it dramatically escalates the exploit chain further. Bad actor can potentially use these credentials to perform a full server takeover cloning the entire Git repository.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
This allows an attacker to take full control of source code, it highlights the importance of properly securing version control systems in web environments. Razz security report reads, To gain unauthorized access to a production server an attacker exploited Bitbucket Pipelines, reads .
While discovering the pipeline configuration file threat actor modified it to include their own SSH (Secure Shell) public key in the server’s authorized_keys file.
The altered pipeline script used the atlassian/ssh-run:0.2.8 pipe to execute commands on the target server (damn.vulnerable.site) as the ‘ubuntu’ user.
This modification allowed the attacker to add their key using the command: “echo ssh-rsa AAAA…snip…sw== >> /home/ubuntu/.ssh/authorized_keys”.
The next pipeline run is triggered by a code push to the master branch, such types of changes allows the attacker to gain SSH access to the server.
With this foothold, bad actor took shell access and full control over the compromised server, while this includes the ability to execute arbitrary commands.
Moreover, they noted a potential privilege escalation vulnerability, and this flaw could lead to root access, further expanding their control over the system.
This exploit chain highlights the dangers of exposing sensitive directories, like the .git folder, to the public and abusing CI/CD pipelines.
Mitigations
Here below we have mentioned all the mitigations:-
Make sure to regularly monitor and review SSH key access.
Remove outdated or unnecessary SSH keys.
Block public access to your .git directory.
