pentester.land· Mar 30, 2023· by Nadav Noy

Remote Code Execution Vulnerability in Azure Pipelines Can Lead To Software Supply Chain Attack

Open Original Article ↗
Target Program: Microsoft (Azure DevOps Pipelines)
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.
#RCE#CI/CD#Supply chain attack

More Writeups Like This

pentester.land

Fixing Typos And Breaching Microsoft’s Perimeter

by John Stawinski, Adnan Khan (@adnanthekhan)
pentester.land

Wiz Research finds architecture risks that may compromise AI-as-a-Service providers and consequently risk customer data; works with Hugging Face on mitigations

by Shir Tamari (@shirtamari), Sagi Tzadik (@sagitz_)
pentester.land

Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk

by Andrey Polkovnichenko, Brian Moussalli
pentester.land

RoguePuppet – A Critical Puppet Forge Supply Chain Vulnerability

by Adnan Khan (@adnanthekhan)