TMA-GITLAB-2.1.10

Ensure webhooks of the build environment are secured

높음레벨 1수동 검토gitlab

설명

Use secured webhooks of the build environment. Webhooks are used for triggering an HTTP request based on an action made in the platform. Typically, build environment feature webhooks for a pipeline trigger based on source code event. Since webhooks are an HTTP POST request, they can be malformed if not secured over SSL. To prevent a potential hack and compromise of the webhook or to the environment or web server excepting the request, use only secured webhooks.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

For each webhook in use, ensure it is secured (HTTPS) via the following process: - In your project or group, on the left sidebar, select Settings > Webhooks. - For each webhook, click Edit. - Verify if the Enable SSL verification checkbox is checked. - Select Add webhook.

조치 방법

조치 방식: 가이드 또는 인프라 패치

For each webhook in use, change it to secured (over HTTPS). - In your project or group, on the left sidebar, select Settings > Webhooks. - For each webhook, click Edit. - Ensure the Enable SSL verification checkbox is checked. - Select Save.

속성

운영 체제: 모두
태그: devsecopsgitlab
참고 자료: CIS GitLab Benchmark v1.0.1 - 2.1.10 Ensure webhooks of the build environment are secured