Untrusted contribution executed by privileged CI
A trusted workflow fetches or loads contribution-controlled code, configuration, or dependencies and executes them with authority unavailable to the contributor.
Candidate CWE: CWE-829
Test hypothesis#
Map event → exact fetched revision → executed Makefile/test/install hook → token or environment authority. Verify current checkout protections, explicit opt-outs, manual fetches, and approvals. Use an owned fixture and harmless output; a pull_request_target trigger alone does not prove this chain. For GitLab, record fork/source configuration, parent execution project and trigger actor separately; verify protected-resource restrictions for the installed version.
Evidence required#
Concrete low-trust contribution path, executable file, workflow and action SHA, relevant policy/defaults, dummy-token fixture results, and source-supported privilege scope. Separate confirmed settings from maintainer-only facts.
Rule out false positives#
Only trusted base code executes; fork material is inspected exclusively as data; current checkout protections block the path; or no intended trust boundary is crossed.
Playbook and command references#
- CI and releases: trace untrusted input into privileged work — Audit workflow events, shell interpolation, untrusted builds, artifact consumers, and release identity as one privilege chain.
- GitLab pipelines: contribution, job token and runner boundaries — Trace GitLab execution context, included configuration, downstream inputs, job-token permissions and runner reuse using private synthetic fixtures.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
- T1195.001 · Supply Chain Compromise: Compromise Software Dependencies and Development Tools — Only if: A controlled reproduction shows maliciously modified dependency or development-tool content being consumed through a software supply chain, such as a substituted reusable build action. Not established by: An old vulnerable dependency, an SBOM finding, or arbitrary CI log access does not prove supply-chain compromise. Show the manipulated component and consumer path.
- T1195.002 · Supply Chain Compromise: Compromise Software Supply Chain — Only if: A controlled release/update workflow accepts modified application code or a substituted compiled artifact before delivery to its final consumer; prove consumption in a lab. Not established by: Access to a build log, ability to upload an unused artifact, or an ordinary software vulnerability does not establish malicious software distribution.