Misconfigurations
Comprehensive list of misconfiguration detectors
Introduction
Sotreia introduces detectors for 9 different security misconfigurations. The tool, however, is extendible, meaning that new misconfiguration rules can be added and used at any time.
Misconfiguration Categories
The following are the categories used to group Soteria's security misconfigurations. These groups have been taken from the OWASP Top 10 CI/CD Security Risks.
- CICD-SEC-3: Dependency Chain Abuse
- CICD-SEC-4: Poisoned Pipeline Execution
- CICD-SEC-5: Insufficient Pipeline-Based Access Controls (PBAC)
- CICD-SEC-7: Insecure System Configuration
- CICD-SEC-9: Improper Artifact Integrity Validation
Comprehensive List
| Category | Misconfiguration | Description | Severity | Rule |
|---|---|---|---|---|
| CICD-SEC-3 | no-hash-version-pin | Always use the full hash when referring to the version of an external Github Action (especially third-party ones). | Low | |
| CICD-SEC-4 | unconditional-injection | Using 'issues' as trigger, no conditional statement, and Github context or local env variables in run sections can lead to code injection. | High | |
conditional-injection | Using 'issues' as trigger, no conditional statement, and Github context or local env variables in run sections can lead to code injection. | Medium | ||
pwn-request | Using 'pull-request-target' as a trigger, together with a checkout of the code from the pull request branch, can make the workflow susceptible to remote code execution. | High | ||
| CICD-SEC-5 | coarse-permission | Permissions shouldn't be coarse, they should be finegrained on the specific permissions (no default/read-all/write-all permissions). | Medium | |
global-secret | When declaring a secret, always declare it locally (step/container scope) and not globally (workflow/job scope). | Medium | ||
| CICD-SEC-7 | self-hosted-runner | When using self-hosted runners (especially in public repos), a user could fork the repo and send malicious pull requests to try and escape the sandbox. | Medium | |
| CICD-SEC-9 | caching-in-release | Caching in a release workflow can lead to supply chain attacks such as cache poisoning. This is especially dangerous when using self-hosted runners. | Critical | |
unsafe-artifact-download | Downloading artifacts without specifying the path and commit/run_id can lead to privacy escalation in the pipeline. | Critical |