Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Cordyceps CI/CD flaws expose 300+ GitHub repositories to supply-chain attacks. The issue allows attackers to hijack workflows and compromise open-source supply chains.
Intelligence analysis by Llama 3.3 70B
A new class of CI/CD workflow weakness, codenamed Cordyceps, has been discovered, allowing attackers to hijack workflows and compromise open-source supply chains.
Imagine a big library where people share code. The Cordyceps flaw is like a secret door that lets bad people sneak in and change the code without permission, which can cause big problems.
Analysis
Introduction to Cordyceps Flaw
The Cordyceps flaw is a critical exploitable pattern in CI/CD workflows that allows attackers to hijack workflows and compromise open-source supply chains. According to Elad Meged, founding engineer and security researcher at Novee Security, the flaw is exploitable by any unauthenticated user, requiring only a free account to forge approvals, push code, or steal credentials.
Impact of the Flaw
The Cordyceps flaw has severe downstream impacts, enabling attacker-controlled code execution, credential theft, and supply chain compromise. Novee Security's scan of about 30,000 high-impact repositories has revealed more than 300 to be fully exploitable. The flaw affects dozens of the largest organizations worldwide, including Microsoft, Google, Apache, and Cloudflare.
Technical Details of the Flaw
The core of the problem lies in weak CI/CD configurations that grant pull requests (PRs) more permissions than they should have. PRs are proposals to merge code changes from one branch into the main project. However, because an untrusted PR can trigger privileged workflows, it can open the door to command injection, privilege escalation, and supply chain compromise. The vulnerability exists only in the composition – untrusted data crossing a trust boundary that no one audited.
Key points
- Cordyceps flaw exposes 300+ GitHub repositories to supply-chain attacks
- The flaw allows attackers to hijack workflows and compromise open-source supply chains
- It affects dozens of the largest organizations worldwide, including Microsoft, Google, Apache, and Cloudflare
The discovery of the Cordyceps flaw can lead to improved CI/CD security practices, and organizations can take steps to harden their workflows and prevent such attacks. By addressing this vulnerability, the open-source community can become more secure.
The Cordyceps flaw poses a significant risk to the security of open-source supply chains, and if left unaddressed, it can lead to severe consequences, including compromised repositories and stolen credentials. The fact that it can be exploited by any unauthenticated user makes it a pressing concern.
