Skip to main content

DroneCI Access Token

DroneCI is a popular continuous integration and continuous deployment (CI/CD) platform that automates the software delivery process. An access token in DroneCI is used to authenticate API requests and perform actions on behalf of a user or service account. Exposure of this token is a significant security concern as it can grant unauthorized access to build pipelines, source code, and deployment environments, potentially leading to data breaches and unauthorized code execution.

How Does It Look​

Access tokens can appear in various contexts, such as:

  • Environment variables:

    export DRONE_TOKEN="drone_xxx1234567890"

  • Configuration files (YAML):

    drone:
      token: "drone_xxx1234567890"

  • Code snippets:

    headers = {"Authorization": "Bearer drone_xxx1234567890"}

  • Connection strings:

    https://api.drone.io?access_token=drone_xxx1234567890

Severity​

  • 🔴 Critical

This severity level is due to the extensive access that a DroneCI access token can provide. With this token, an attacker can manipulate CI/CD pipelines, access sensitive source code, and deploy malicious code to production environments. The blast radius includes all projects and environments associated with the compromised token.

What Can an Attacker Do?​

With immediate access to a DroneCI access token, an attacker can perform a variety of malicious actions:

An attacker can immediately access and manipulate CI/CD pipelines, potentially injecting malicious code or altering build processes.

Key actions an attacker can perform:

  • Modify build pipelines: Change build configurations or scripts (if the token has write permissions).
  • Access source code: Download or view sensitive code repositories (if the token grants repository access).
  • Deploy unauthorized code: Push malicious code to production environments (if deployment permissions are enabled).
  • Extract secrets: Retrieve environment variables and secrets used in builds (if not encrypted or protected).

Additionally, an attacker could escalate their access by leveraging the compromised token to gain further credentials or access to other integrated systems, potentially leading to lateral movement across the network.

Real-World Impact​

The exposure of a DroneCI access token poses significant business risks, including:

The primary impact is the potential for unauthorized code execution and data breaches.

Potential consequences include:

  • Data Exposure: Source code and sensitive configuration files (if the token has read access to repositories).
  • Financial Loss: Costs associated with unauthorized resource usage or downtime (if the attacker disrupts build processes).
  • Operational Disruption: Interruption of CI/CD pipelines and deployment processes (if the attacker modifies or deletes pipelines).
  • Reputational Damage: Loss of customer trust and brand integrity due to security breaches.

In the worst-case scenario, the exposure could lead to a cascading effect where compromised code is deployed to production, affecting end-users and potentially leading to widespread service outages.

Prerequisites for Exploitation​

To exploit a DroneCI access token, an attacker needs:

  • Network access: Ability to send requests to the DroneCI API.
  • Additional context: Knowledge of the DroneCI server endpoint and associated project details.
  • No rate limits: Exploitation is easier if there are no strict rate limits or IP restrictions in place.

How to Verify If It's Active​

To verify if a DroneCI access token is active, use the following command:

curl -H "Authorization: Bearer [TOKEN]" https://api.drone.io/api/user

Valid credential response: A successful response will return user details in JSON format, indicating the token is active.

Invalid/expired credential response: An error message or unauthorized status code will be returned, indicating the token is invalid or expired.

Detection Patterns​

Common Variable Names:

  • DRONE_TOKEN
  • DRONE_ACCESS_TOKEN
  • DRONE_API_TOKEN
  • DRONE_SECRET
  • DRONE_AUTH_TOKEN
  • DRONE_CI_TOKEN

File Locations:

  • .drone.yml
  • config.yml
  • .env
  • settings.json
  • drone-config.yaml

Regex Pattern:

drone_[a-zA-Z0-9]{16,}

Remediation Steps​

  1. Revoke immediately - Go to DroneCI > Settings > Tokens and delete the compromised token.
  2. Audit access logs - Review DroneCI audit logs for unauthorized pipeline executions or API requests during the exposure window.
  3. Assess blast radius - Identify all systems, applications, and environments that used the exposed credential.
  4. Rotate credential - Generate a new access token in DroneCI with least-privilege permissions.
  5. Update dependent systems - Deploy the new credential to all applications and update CI/CD pipelines securely.
  6. Harden access controls - Enable IP allowlisting in DroneCI and require two-factor authentication for all users.
  7. Implement secrets management - Migrate credentials to a secrets manager (HashiCorp Vault, AWS Secrets Manager) to prevent hardcoding.
  8. Add detection controls - Set up pre-commit hooks and repository scanning to catch credential leaks before they reach production.

Credential exposures often go undetected for extended periods, increasing the window for exploitation. As a long-term strategy, plan to establish an internal process or engage an external vendor for continuous external exposure monitoring. This helps identify leaked secrets across public repositories, paste sites, dark web forums, and other external sources before attackers can leverage them. Proactive detection and rapid response are essential to minimizing the impact of credential leaks.

References​