Abuse of Repository Webhooks to Access Hundreds of Internal CI Systems
summary
Shows a concrete attack chain that turns SaaS SCM webhooks into a remote access vector against internal CI: creating webhooks to Jenkins login endpoints that accept credentials in URL, automating brute force via webhook event logs, and abusing GitLab’s redirect-following to convert POSTs into authenticated GETs that return console logs. Demonstrates unauthenticated RCE using Orange Tsai RCE served through a redirected webhook and a wide-scale scan that starts from 3.6 million domains and finds 115 Jenkins domains reachable from SCM IP ranges.
AI-written summary · about
chapters (11)
- 0:00Introduction and presenters
- 2:31Attacker motivations and CI/CD risks
- 5:01Webhook abuse overview
- 8:34Bypassing webhook restrictions
- 11:06Jenkins login mechanism abuse
- 15:47GitLab redirection exploitation
- 19:04Exploiting known CI vulnerabilities
- 22:20Scaling attacks to multiple Jenkins instances
- 25:11Attacking other platforms like Azure DevOps
- 26:35Mitigation and security recommendations
- 28:44Q&A session
related talks
38mHacking Jenkins
45mLive Hacking Cloud Architectures
51mHow hackers can breach your C.I / C.D systems
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
30mHow to hack an Angular app?
28mPwning the CI (with GitHub Action Workflows)
41mLive Hacking: Breaking into Your Web App
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain