Secrets in CI/CD
Find leaked secrets in CI/CD pipelines, build logs, artifacts, and deployment configs during cloud CTF challenges.
Secrets in CI/CD
CI/CD systems frequently hold high-value credentials: cloud keys, registry tokens, signing keys, and deployment secrets. In CTFs, one leaked pipeline variable can become full infrastructure access. The secrets leak through predictable channels — build logs, git history, workflow YAML files, container image layers, and misconfigured OIDC trust.
Attack Chain
Where Secrets Leak
| Location | Example Leak |
|---|---|
| Build logs | Printed env vars or debug output |
| Artifacts | .env, kubeconfig, AWS credentials file |
| Repo history | Removed but recoverable via git log |
| Workflow YAML | Hardcoded tokens in steps |
| Container images | Keys copied at build time, left in layers |
| OIDC role trust | Overly broad audience/subject conditions |
Discovery Workflow
Scan for Secret Patterns
rg "AWS_|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|BEGIN RSA|BEGIN OPENSSH" --type yaml
trufflehog filesystem .Check Git History
git log -p -- .env .github/workflows .gitlab-ci.yml
git log --all --oneline | head -50
git show <commit>:.env # view deleted file at specific commitSecrets removed in later commits still exist in the git history.
Inspect Build Artifacts
rg "token|secret|aws|kube|passwd" dist build out artifacts -i
docker history --no-trunc <image>
docker save <image> | tar x # extract all layersReview CI Configuration Files
.github/workflows/*.yml.gitlab-ci.ymlJenkinsfiledocker-compose*.ymlMakefile,build.sh,deploy.sh
Validate Any Discovered Credentials
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
aws sts get-caller-identity
# Then enumerate S3, Secrets Manager, etc.Platform-Specific Attack Patterns
pull_request_target Exploitation
Unsafe pattern — attacker-controlled code runs in privileged context:
# VULNERABLE: checks out PR head code and runs it with secrets access
on: pull_request_target
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
ref: ${{ github.event.pull_request.head.sha }} # attacker code!
- run: npm test # runs attacker's package.json scripts
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} # exposed!Exploit: Submit a PR modifying package.json preinstall scripts to exfiltrate $AWS_ACCESS_KEY_ID.
What to Look For
| Field | Red Flag |
|---|---|
| Trigger | pull_request_target + code checkout |
| Ref | github.event.pull_request.head.* |
| Permissions | id-token: write, contents: write |
| Runner | Self-hosted accessible to external PRs |
If workflow has id-token: write and assumes a cloud role, attacker code execution in the job gets the OIDC token → full cloud role credentials.
Key Files to Audit
Checklist
- Enumerate CI/CD config files and workflow definitions
- Search git history for removed
.envand credential files - Scan build artifacts and container layers for leaked values
- Look for
pull_request_target+ PR head checkout pattern - Check OIDC trust policies for overly broad conditions
- Validate discovered credentials with
aws sts get-caller-identity
Last updated on