Subverting the Secure: Covert Injections Within CI/CD Pipelines

This research investigates a critical vulnerability in the prevalent assumption that adopting DevSecOps methodologies inherently guarantees secure software delivery. We explore the alarming potential for a seemingly robust DevOps pipeline to be maliciously exploited, transforming a securely developed application into an insecure artifact without altering its original codebase. Through a targeted experimental setup utilizing a typical Kubernetes (K8s) and Jenkins-based CI/CD environment, we demonstrate four distinct attack vectors. These scenarios include privilege escalation within K8s, surreptitious manipulation of CI/CD build processes, unauthorized exposure of internal network services, and leveraging compromised accounts for root access. Our findings conclusively illustrate that even in a DevSecOps-enabled ecosystem, vigilance in pipeline design and continuous security monitoring are paramount, challenging the notion that a DevSecOps environment alone suffices for software integrity.