//Azure DevOps - Security Testing Guide (Ado-STG)/Organization

Testing for Insecure Pipeline Settings

ID:	AdoSTG-ORG-02

If you need help assessing the security of your Azure DevOps or organization, we offer a wide range of security services. So, always feel free to reach out at: Sales@enterprisesoftproducts.com

NOTICE: The Azure DevOps - Security Testing Guide (Ado-STG) is currently in BETA; this means that there might be substantial changes and some parts may contain errors or not be fully implemented.

1 - Summary

The "pipeline settings" under "organization settings" contains a number of key security settings related to pipelines, their configuration and their access control. These settings help increase the overall security posture of the ADO organization by limiting dangerous functionality and restricting use of Github forks and outdated software versions and more.

2 - Test Objectives

Identify insecure settings in an Azure DevOps organization

3 - How to Test

These issues can be assessed from the organization's settings page in the web interface: https://dev.azure.com/{organization}/_settings/pipelinessettings.

Review the following items under 'pipelines' -> 'settings':

Limit variables that can be set at queue time
Limit job authorization scope to current project for non-release pipelines
Limit job authorization scope to current project for release pipelines
Protect access to Azure DevOps repositories in YAML pipelines
Limit building pull requests from forked GitHub repositories
Restrict out of support Node.js versions in pipeline tasks
Enable shell tasks arguments validation

4 - Remediation

Reconfigure the settings to the following:

Setting	Reccomended value	Reasoning
Limit variables that can be set at queue time	On	Variable set at runtime allow for command injection into the pipeline by users with privileges over the project/repo/pipeline.
Limit job authorization scope to current project for non-release pipelines	On	Allows for the restrictions of the scope for none release pipelines thus limiting potential impact in case of compromise.
Limit job authorization scope to current project for release pipelines	On	Release pipelines can run with collection scoped access tokens, this allows for restricting that access.
Protect access to Azure DevOps repositories in YAML pipelines	On	Applies several checks and approvals for pipelines and provides fine-grained permissions for the pipelines.
Limit variables that can be set at queue time	On	Same as with runtime just for queue time.
Limit building pull requests from forked GitHub repositories	On	Allows for organization wide settings for building forked repos. such as disabeling it entierly, requireing security checks by team members, and also using customized rules.
Restrict out of support Node.js versions in pipeline tasks	On	-
Enable shell tasks arguments validation	On	Set of checks to limit effectiveness of code injection in task arguments

5 - References

https://www.cloudthat.com/resources/blog/azure-devops-best-practices-part-1
https://learn.microsoft.com/en-us/azure/devops/pipelines/security/inputs?view=azure-devops#limit-variables-that-can-be-set-at-queue-time