The talk is divided into two main parts: an offensive demonstration and a defensive strategy session.
\r\n\r\nWe will begin with a realistic demonstration of attack scenarios showing how a basic contributor-level account can be used to hijack a CI/CD pipeline, escape the provided use cases and fully compromise the infrastructure through Terraform integration. To reflect real-world conditions, common pipeline protections will be enabled\u2014and bypassed. Key topics include:
\r\nWe\u2019ll explore how attackers can achieve RCE through configuration file manipulation or config file poisoning, Terraform constructs (e.g., external data sources, malicious custom providers or modules, abuse of provisioners), and other legitimate pipeline features.
Techniques to bypass provider restrictions, function or module blacklists, and CI/CD step filters will be demonstrated, showing how misconfigurations or insufficient validation open the door to exploitation.
\r\nOnce initial execution is achieved, we\u2019ll show how attackers can perform lateral movement in the underlying infrastructure, such as:
\r\nWith the offensive risks clearly laid out, we\u2019ll move on to the defensive strategies. This section is divided into two phases:
\r\nThis proactive phase aims to secure the pipeline by design. We\u2019ll cover:
\r\nEven well-protected pipelines require active monitoring to catch suspicious activity. We\u2019ll discuss:
\r\n