T08 · Insecure Dependencies
Warning
- Location
SKILL.md:246- Finding
Unpinned Third-Party Dependencies in CI/CD Workflow
- Content
View full analysis
aws-secret-access-key: $ - name: Terraform initialization run: cd infra && terraform init - name: Compliance check run: | pip install checkov checkov -d infra/ --framework terraform - name: Terraform plan run: cd infra && terraform plan -out=tfplan - name: Upload plan uses: actions/upload-artifact@v3 with: name: tfplan path: infra/tfplan apply: name: Terraform apply needs: plan if: github.ref == 'refs/heads/main' && github.event_name == 'push' runs-on: ubuntu-latest environment: production steps: - uses: actions/checkout@v3 - name: Download plan uses: actions/download-artifact@v3 ``` ### Technical Analysis The workflow example installs `checkov` without an exact version or package hash. Consequently, every CI execution may resolve a different package release and a different set of transitive dependencies. If an upstream package, maintainer account, or package registry entry is compromised, attacker-controlled code could execute during installation or subsequent invocation. The workflow also references GitHub Actions through mutable major-version tags such as `@v2` and `@v3`. These references do not cryptographically bind execution to the code reviewed when the workflow was created. A compromised upstream action repository or modified tag could therefore change the code executed by future workflow runs. This risk is particularly important because the workflow configures AWS credentials before installing and running the unpinned dependency. Depending on runner and credential isolation, a compromised co ...[truncated 1696 chars]- Remediation
View remediation
' ``` 2. Use a lock file with cryptographic hashes, such as a `requirements.txt` generated by `pip-compile`: ```text checkov== \ --hash=sha256: ``` Install it with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin every GitHub Action to a reviewed full commit SHA rather than a mutable major-version tag: ```yaml - uses: actions/checkout@ - uses: aws-actions/configure-aws-credentials@ - uses: actions/upload-artifact@ - uses: actions/download-artifact@ ``` 4. Add comments identifying the corresponding action release version so pinned commits remain maintainable. 5. Use automated dependency update tooling, but require human review and CI validation before accepting updated package versions or action SHAs. 6. Restrict the workflow token and cloud identity to the minimum permissions required. Use short-lived, OpenID Connect-based cloud credentials instead of long-lived access keys. 7. Separate compliance scanning and Terraform planning from deployment credentials. Do not expose production cloud credentials to dependency-installation steps unless strictly necessary. 8. Restrict outbound network access where supported, retain protected production environments, and require manual approval before applying infrastructure changes. 9. Verify package provenance, review dependency changes, and use trusted internal mirrors or registries for security-sensitive CI dependencies. ]]>