Vulnerability in Renovate package: Azure DevOps token leakage in logs
Summary
GHSA-36rh-ggpr-j3gj: Renovate vulnerable to Azure DevOps token leakage in logs. Affects renovate versions >= 19.180.0, < 23.25.1. Fixed in 23.25.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Renovate is an open-source package used for automating dependency updates in software projects. It integrates with various development platforms, including Azure DevOps. This vulnerability specifically affects Renovate users who utilize Azure DevOps. The issue arises from the logging of the http.extraheader=AUTHORIZATION parameter without redaction, potentially exposing the bot's token in server or pipeline logs.
Vulnerability Detail
The vulnerability allows unauthorized access to the bot's token in Azure DevOps logs. If the logs containing the token have been saved in a location accessible to others, it poses a security risk. Attackers could potentially use the exposed token to gain unauthorized access to Azure DevOps resources. To mitigate this risk, it is recommended that affected users revoke their existing bot credentials and generate new ones after upgrading to a fixed version of Renovate.
How To Fix
Minimum fixed version
23.25.1
This is the first release that contains the fix.
npm install renovate@23.25.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid sharing Renovate logs with anyone who cannot be trusted with access to the token. By limiting the exposure of the logs, the risk of token leakage can be minimized.
Conclusion
The vulnerability in the Renovate package exposes Azure DevOps users to the risk of token leakage in logs. To mitigate this risk, it is crucial to upgrade to a fixed version of Renovate and follow the recommended steps to revoke and regenerate bot credentials. Additionally, caution should be exercised when sharing Renovate logs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for renovate →
FAQ
This vulnerability affects Renovate users who utilize Azure DevOps.
The impact is specific to Azure DevOps users. The bot's token may be exposed in server or pipeline logs, potentially leading to unauthorized access to Azure DevOps resources.
To mitigate the risk, it is recommended to revoke existing bot credentials and generate new ones after upgrading to a fixed version of Renovate. Additionally, avoid sharing Renovate logs with untrusted individuals.
Users should upgrade their Renovate package to version 23.25.1 or later to fix this vulnerability.
Yes, as a temporary workaround, users should avoid sharing Renovate logs with anyone who cannot be trusted with access to the token.
References
Related vulnerabilities
Recent vulnerabilities recorded for renovate.
