Résumé
CircleCI runs the build pipelines for thousands of engineering teams, which means it holds their deepest secrets: the deploy keys, API tokens, and credentials that move code to production. In December 2022, all it took to reach those was malware on one engineer's laptop. An infostealer that antivirus never caught lifted a valid, 2FA-protected login session straight out of the engineer's browser, letting the attacker walk in as that engineer with the second factor already satisfied. They reached production stores of customer secrets, forcing CircleCI to tell every customer to rotate every credential they had ever stored. It is the lesson that a stolen session cookie bypasses MFA, and that one infected laptop can compromise thousands of pipelines.
How it happened
The entry point was infostealer malware on a CircleCI engineer's laptop, which the company's antivirus did not detect. The malware stole a valid SSO session cookie, and crucially, that session was already backed by two-factor authentication. Because a session cookie represents an already-authenticated session, replaying it (session hijacking) let the attacker impersonate the engineer and bypass the second factor entirely, no re-authentication required. The engineer had privileges to generate production access tokens, which the attacker used to reach the secret stores.
With that access, the attacker exfiltrated data from a subset of production stores, including customer environment variables, tokens, and keys, the secrets that thousands of customers had stored in CircleCI to run their builds. The data had been encrypted at rest, but that gave no protection, because the attacker dumped the encryption keys straight out of a running process. CircleCI rotated all customer Project and Personal API tokens along with GitHub and Bitbucket OAuth tokens, and urged every customer to rotate any secret used in the exposure window, 16 December 2022 to 4 January 2023. The company did not detect the breach itself: a customer flagged suspicious GitHub OAuth activity on 29 December, twelve days after the laptop was first infected. Fewer than five customers reported downstream unauthorized access, but every customer had to act as if theirs was exposed.
The damage
The practical fallout was an industry-wide scramble: thousands of companies forced to rotate every credential they had stored in CircleCI, even though few were directly exploited. That is the nature of a CI/CD vendor, it concentrates thousands of organisations' secrets in one place, so a single breach becomes a fleet-wide event. It was the same concentration risk as the Codecov attack, reached by a different route.
Why CircleCI still matters
CircleCI leaves two lessons. First, session cookies bypass MFA: a stolen session is "already logged in," so the second factor is never re-checked, which is why sessions should be bound to device posture and kept short-lived (CircleCI's own structural fix was to add step-up authentication so a stolen session alone can no longer reach production). Second, infostealers on engineer endpoints are a top breach vector that signature antivirus misses, so behavioural endpoint detection (EDR) matters. And on the secrets side, prefer short-lived, OIDC-federated tokens over long-lived secrets stored in the vendor, scope them per project, and rotate everything after any CI vendor breach. It is a sibling of the Codecov compromise.
Comment le corriger
- Assume every secret stored in or used through the platform is exposed: rotate all customer tokens, keys, and OAuth grants, and tell customers to rotate theirs across the exposure window.
- Invalidate all sessions and shorten session lifetimes, since a stolen session cookie was the entry point.
- Rebuild the infected endpoint and hunt for what the infostealer accessed beyond the session.
Comment l’éviter
- Prefer short-lived OIDC-federated tokens over long-lived secrets stored in the CI vendor; rotate every stored credential after any CI vendor breach.
- Scope CI secrets to least privilege and per-project so one platform compromise cannot expose every pipeline.
- Bind SSO sessions to device posture and shorten session lifetimes so a stolen session cookie expires fast.
- Deploy stealer-malware detection (EDR) on engineer endpoints, not signature antivirus alone.
- Audit third-party OAuth grants and revoke unused CI integrations to shrink the blast radius of a token leak.
Références
Vulnérabilités liées
Tout OpSec →- HIGHOPSEC-INTERNET-ARCHIVE-2024
The Internet Archive, the nonprofit behind the Wayback Machine, had a brutal October 2024: a data breach, a website defacement, and a wave of DDoS attacks, all at once. Underneath the chaos was an unglamorous root cause. An authentication token sat in plain text in a public config file; the team rotated it repeatedly, but each new token landed right back in the same exposed file, so the leak never actually closed. With it, an attacker downloaded the source code, found more credentials hardcoded inside, and walked out with a database of 31 million users. Weeks later a second token from that same stolen code, for the support system, exposed 800,000 support tickets, some with people's ID documents. It is the lesson that rotating a secret is useless if it goes straight back into a public file, and that one leak unravels everything.
- HIGHOPSEC-MERCEDES-BENZ-2024
Publicly disclosed January 30, 2024, a Mercedes-Benz employee accidentally committed a GitHub authentication token to a public repository, leaving it exposed from September 29, 2023. RedHunt Labs found the token during an internet-wide scan; it granted unrestricted, unmonitored access to Mercedes-Benz's internal GitHub Enterprise Server, allowing anyone to download private source-code repositories that could contain API keys, cloud access keys, database connection strings, blueprints, and SSO passwords. After notification, the token was revoked on January 24, 2024. Mercedes-Benz stated customer data was not affected but could not confirm whether anyone besides the researchers accessed the repositories during the exposure window.
- CRITICALOPSEC-MIDNIGHT-BLIZZARD-2024
In January 2024, Microsoft revealed that Russia's foreign-intelligence service, the same APT29 behind SolarWinds, had been reading the email of its senior leadership. The way in was almost insulting in its simplicity: a forgotten, non-production test account with a weak password and no MFA. The attackers guessed the password by spraying common ones across many accounts, then pivoted through a forgotten over-privileged application to grant themselves access to corporate mailboxes, including those of executives and the security and legal teams. It is the lesson that your security is only as strong as the account you forgot about, and that even Microsoft's perimeter fell to a missing MFA checkbox.
- HIGHOPSEC-OKTA-2023
Okta is an identity provider: the single front door thousands of companies use to log their employees into everything. So when Okta's customer-support system was breached in late 2023, the blast radius was a who's-who of security-conscious companies. The entry point was almost mundane. An employee had signed into their personal Google account on an Okta laptop and saved a corporate service-account password into it; the attacker got that password and walked into Okta's support system. There they downloaded diagnostic files that customers had uploaded, some of which contained live session tokens, and used those tokens to step directly into the customers' own Okta environments. It is the lesson that session tokens are as good as passwords, support systems are production systems, and a personal browser profile can be the crack in the wall.
- CRITICALOPSEC-23ANDME-2023
23andMe held the most personal data there is: people's DNA. In 2023 attackers got into more than 18,000 accounts and, through a single social feature, turned that into the genetic and ancestry data of roughly 6.9 million people. The break-in required no flaw in 23andMe at all. Attackers simply took username-and-password pairs leaked from other companies' breaches and tried them, betting, correctly, that people reuse passwords. The accounts had no MFA, and 23andMe did not notice the five-month wave of automated logins. From those footholds, the attackers scraped relatives' data through an opt-in feature, and the fallout, fines, a $50 million settlement, and ultimately bankruptcy and a fire-sale of the DNA database itself, shows that a breach can be fatal even when your own systems were never hacked.
- HIGHOPSEC-MICROSOFT-SAS-2023
Microsoft's AI research team shared open-source training data via an Azure Storage Shared Access Signature (SAS) token committed to a public GitHub repo around July 2020. The token was misconfigured to scope access to the entire storage account with full-control permissions instead of the intended read-only bucket, so anyone with the link could view, delete, and overwrite files. Wiz researchers discovered it in June 2023, finding 38 terabytes of exposed internal data including two employees' workstation disk backups with secrets, private keys, passwords, and over 30,000 internal Teams messages. Writable pickle-format models created a model-poisoning supply-chain risk; Microsoft revoked the token and reported no customer data was exposed.