DEF CON 32 - OH MY DC Abusing OIDC all the way to your cloud - Aviad Hahami

The video explores how OIDC (OpenID Connect) misconfigurations in CI/CD pipelines can lead to unauthorized access to cloud resources, emphasizing the risks of lax policies and improper claim assertions. 0:30

Key Takeaways:
• OIDC in CI/CD uses identity federation to authenticate machines, but the CI provider acts as both the CI and identity provider, creating trust dependencies 2:51.
• ID tokens contain claims like sub, repo, and workflow, and their values can be exploited if policies use wildcards or unsafe patterns 9:02.
• "No config" or lax policies allow any ID token to pass, enabling attackers to impersonate identities via copy-paste workflows 13:55.
• Custom claim formats, especially in the sub field, are vulnerable to order-based attacks—flipping claim order can bypass authorization 22:56.
• Pipeline abuse via pull request forks can trigger vulnerable CI executions, leading to access to restricted cloud resources 25:33.
• Vendor misconfigurations, such as Circle CI granting OIDC tokens on any fork pull request, enable broad access to cloud accounts without proper opt-in 32:00.

Attackers can exploit weak policies, unsafe claims, or vendor flaws to gain unauthorized access. Organizations should harden pipelines, avoid wildcards, validate claim origins, and ensure proper identity assertions. 37:12

Sources:

• 0:30 Overview of OIDC in CI/CD and its authentication flow.
• 2:51 Explanation of OIDC