TLDR Tech / InfoSec
Auditing GitLab: The CI/CD Kill Chain
Black Hills Information Security released GoGatoZ, a Go-based GitLab CI/CD auditing tool ported from Gato-X, and used it to scan 3,757 public gitlab.com projects across three campaigns (broad DevOps keywords, Fortune 500 targeting, and industry verticals), surfacing 7,331 findings, including 1,580 HIGH severity issues with roughly two-thirds of projects exhibiting at least one misconfiguration. Dominant attack classes included unprotected fork merge request pipelines (1,971 findings) that let attackers modify .gitlab-ci.yml in a fork to exfiltrate CI variables, privileged Docker runners (259) enabling container-to-host escape, curl | bash patterns in 150 pipelines, $CI_COMMIT_REF_NAME and $CI_MERGE_REQUEST_TITLE injection into shell scripts (288), exposed self-hosted runners (177), and 347 plaintext secrets, with a systematic false-positive workflow trimming about 40% of keyword-targeted findings as noise. Defenders should pin all include directives and container images to commit SHAs, move secrets to masked and protected CI variables, disable fork MR pipeline access to variables, restrict self-hosted runners to protected branches only, drop privileged mode on Docker runners exposed to public projects, and integrate scanners like GoGatoZ into regular audits of internal GitLab instances.
Read the full story