Renovate vulnerable to Azure DevOps token leakage in logs
Moderate severity
GitHub Reviewed
Published
Sep 12, 2020
in
renovatebot/renovate
•
Updated Jan 7, 2023
Description
Reviewed
Sep 14, 2020
Published to the GitHub Advisory Database
Sep 14, 2020
Last updated
Jan 7, 2023
Credits
-
ylemkimon Analyst
Impact
Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the
http.extraheader=AUTHORIZATIONparameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.Patches
Fixed in
Workarounds
Do not share Renovate logs with anyone who cannot be trusted with access to the token.
References