Description

Detects when an identity is allowed to force push to the default branch of an Azure DevOps repository. Azure DevOps grants force push, branch deletion and tag deletion through one permission, so whoever holds it can rewrite the history of the branch the organization releases from or delete it outright. The creator of a branch is granted it on that branch, so a default branch that was never hardened reports its creator.

Detection Strategy

• Lists every project in the Azure DevOps organization and every Git repository inside each project

• Skips repositories with no default branch, since a repository without commits has no branch to protect

• Reads the access control list of the default branch in the Git Repositories security namespace, which returns the identities inherited from the project together with those granted on the branch itself, its creator included

• Reports a vulnerability when any identity's effective permission, with deny taken over allow, includes force push; a list that cannot be read or comes back empty is recorded as unreadable rather than reported as clean