SlowMist CISO Says “Cordyceps” CI/CD Flaw Could Let Attackers Hijack Open-Source Repositories

A newly disclosed high-risk CI/CD security issue dubbed “Cordyceps” could allow attackers to take control of affected open-source code repositories using only a free GitHub account, according to a post by SlowMist’s chief information security officer, 23pds. According to ChainCatcher, the researcher disclosure said the issue was tested and found to affect open-source repositories associated with major organizations including Microsoft, Google, Apache, and Cloudflare. The described attack does not require an enterprise account or any system permissions. Instead, an attacker can submit a malicious pull request and leave a comment to spoof an approval process, steal server keys, and push malicious code. If exploited as described, the technique could enable full control over an organization’s code repository, the post said.