Abusing Repository Webhooks to Access Internal CI/CD Systems at Scale

With the increasing adoption of CI/CD systems, organizations tend to adopt a common CI/CD architecture. This architecture combines SaaS-based source control management systems — such as GitHub and GitLab — with an internal, self-hosted CI/CD solution like Jenkins.

Many organizations using this architecture allow their CI/CD environment to receive webhook events from the SaaS source control vendors to trigger pip...