writeups.xyz / Azure Devops CICD Pipelines - Command Injection With Parameters, Variables And A Discussion On Runner Hijacking

Submitter : c2a

Date: 1 May 2023

Bounty : undisclosed

Vulnerabilities :

• CI/CD
• OS Command Injection
• RCE

Programs :

• Microsoft (Azure DevOps Pipelines)

Authors :

• Sana Oshika (@Bigshika)

Link :
https://pulsesecurity.co.nz/advisories/Azure-Devops-Command-Injection