Securing CI/CD Pipelines: Exploring Vulnerabilities In Workflows
summary
A staged static taint analysis called Argus analyzes GitHub Actions by generating action taint summaries, converting workflows to an intermediate representation and running a YAML/Bash taint engine; it scans inputs like issue titles and outputs actual exploit paths. The project runs on 2.8 million workflows, reports about 27,000 vulnerable workflows including 3,600 high-impact cases, finds ~5,000 zero days, achieves ~93% precision, supports JavaScript and composite actions but not Docker yet, and helps coordinate fixes with GitHub.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:49CI/CD pipeline basics
- 5:42GitHub Actions overview
- 11:46Threat model for CI/CD
- 12:48Command injection examples
- 15:01Limitations of existing tools
- 17:27Introducing Argus tool
- 25:39Workflow intermediate representation
- 30:40Impact classification system
- 31:42Case study: DynamoDB workflow
- 34:31Evaluating Argus on real data
- 37:00Reporting vulnerabilities
- 39:05Securing GitHub workflows
- 42:20Tools and recommendations
- 43:23Conclusion and thanks
related talks
42mProtecting CI/CD from malicious deploys
30mGitHub Actions Security in Python Packages
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
23mBreaking the Build: How Attackers Abuse GitHub Actions
57mGitHub Actions: A Cloudy Day for Security
55mGitHub Actions: Vulnerabilities, Attacks, And Counter-Measures
15mGitHub Actions: a time bomb for supply chain security
47mUnder the Radar: How we found 0-days in the Build Pipeline of OSS Packages