Code Injection

ID:	AdoSTG-AI-02

If you need help assessing the security of your Azure DevOps or organization, we offer a wide range of security services. So, always feel free to reach out at: Sales@enterprisesoftproducts.com

NOTICE: The Azure DevOps - Security Testing Guide (Ado-STG) is currently in BETA; this means that there might be substantial changes and some parts may contain errors or not be fully implemented.

0 - Summary

This section describes how a tester can check if its possible to abuse "AI" functionality to inject untrusted code into a pipelines execution.

This can happen when the pipeline uses untrusted input from a user in a step, thsi can both be used for prompt and code injection.

Notably this will need additional privileges to execute since this will not start a reguler trigger for a pipeline.

1 - Test Objective

Identify pipelines where untrusted input is passed to an "AI" aka. sinks (variables, parameters, macros, templates).
Identify sources of untrusted inputs aka. sources.

2 - How to Test

For this to be an issue the following criteria has to be met:

The pipeline needs to be using an "AI" action, we can check for this by looking at the yaml file and look for strings indicating use of various "AI" providers (please note that this list only includes major well known providers other local of lesser known providers might be used):

1majorProviders = ["claude", "gemini", "copilot", "openai", "codex", "deepseek"] 
2aiAssistants = ["cursor", "coderabbit", "qodo", "pr-agent", "devin"] 
3additionalAiProviders = ["sourcery", "ai-pr-review", "ai-code-review", "cline", "mistral", "llama", "anthropic", "cohere"] 
4selfhostedRuntimes = ["chatgpt", "gpt-4", "gpt-3", "bing-chat", "bard", "phind", "perplexity", "you-ai", "jasper", "tabnine", "ollama"] 
5mcp = ["mcp", "model-context-protocol"]

Then we need to provide untrusted input such as in commit message, branch names etc:

1"Build.SourceVersionMessage",  # Commit message (user-controlled) 
2"Build.SourceBranchName",  # Short branch name (user-controlled via PR) 
3"Build.SourceBranch",  # Full branch ref e.g. refs/heads/feature/foo 
4"Build.RequestedFor",  # Display name of person who triggered build 
5"Build.RequestedForEmail",  # Email of person who triggered build 
6"System.PullRequest.SourceBranch",  # PR source branch name 
7"System.PullRequest.TargetBranch",  # PR target branch name

3 - Remediation

Avoid passing user-controlled input directly to AI tasks. Validate and sanitize input before use.

4 - References

https://githubcom/praetorian-inc/trajan/blob/main/pkg/azuredevops/detections/ai/ai.go