Let's Hack a Pipeline: Argument Injection

This post details the security vulnerability of argument injection in Azure Pipelines when using queue-time variables with script steps. It demonstrates how an attacker can inject malicious commands by manipulating variable values. The post then presents two mitigation strategies: using runtime parameters with defined values and using tool-specific tasks that properly escape inputs. It also provides links to the second and third episodes in the series, focusing on pipeline stealing and shared infrastructure security.