Ensure pipelines are automatically scanned for vulnerabilities

pipeline_scan_vuln

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Family

SCM

Description

Scan for vulnerabilities in build pipelines. It is recommended to use automated tools for detecting known vulnerabilities.

Security

Automatic scanning for vulnerabilities detects known vulnerabilities in pipeline instructions and components, allowing faster patching in case one is found. These vulnerabilities can lead to a potentially massive breach if not handled as fast as possible, as attackers might also be aware of such vulnerabilities.

Mitigation / Fix

Add automated dependency vulnerability scanning to every pipeline, so a vulnerable component is reported on the change that introduces it. The check looks for a known scanner — or an automated dependency-update tool — in the pipeline definitions and build scripts of the project.

This check reads pipeline definitions and build scripts only. A scan run anywhere else — from a developer’s machine, or a pipeline living in another repository — is not visible to it, so the finding stays open until the scanning step belongs to a pipeline this project owns.

Xygeni Open Source Security

Xygeni Open Source Security resolves the dependency graph from the project’s manifests and lock files and reports the known vulnerabilities of the components actually resolved, direct and transitive. Add the scanner command to the workflow:

# Dependencies only
xygeni deps -n $PROJECT -d .

# Or together with the other scans of the same run
xygeni scan --run=deps,sast,secrets -n $PROJECT -d .

On GitHub Actions the same scan is available as an action, and on Azure Pipelines as the xygeni-scanner task with deps: true:

- name: Xygeni Dependencies
  uses: xygeni/xygeni-action@<commit-sha> # pin to a release commit
  with:
    command: deps
    token: ${{ secrets.XYGENI_TOKEN }}

A finding list is only useful if it is acted on: use the scan policies to fail the pipeline on what must not ship, and let remediation open the upgrade pull request for the rest.