Executive brief
Renovate, a popular tool for automating dependency updates, was found to leak sensitive Azure DevOps authentication tokens in its logs. If an organization uses Renovate with Azure DevOps, these secret tokens could be visible to anyone with access to the server or pipeline logs. An attacker with access to these logs could use the leaked tokens to impersonate the bot and gain unauthorized access to the organization's code repositories.
Technical details
A vulnerability in Renovate's logging mechanism causes the 'http.extraheader=AUTHORIZATION' parameter to be recorded without proper redaction when interacting with Azure DevOps. This occurs in versions 19.180.0 through 23.25.0. The flaw allows anyone with read access to the execution logs (such as CI/CD pipeline logs or server stdout) to retrieve the bot's PAT (Personal Access Token). This is a classic information disclosure issue resulting from improper sensitive data handling in logging routines. The issue is resolved in version 23.25.1, which implements proper redaction for these headers.
Affected products
- Renovate Bot renovate >=19.180.0, <23.25.1
Timeline
- 2020-09-12: advisory: Original GitHub Security Advisory published
- 2020-09-14: disclosed: Public disclosure via OSV/GHSA