CyberRota Analysis
AI-GeneratedVersions of Renovate from 19.180.0 to 23.25.1, when integrated with Azure DevOps, improperly log the bot's authorization token in server or pipeline logs due to the unredacted logging of the git http.extraheader=AUTHORIZATION parameter. This vulnerability allows unauthorized access to bot credentials for anyone with access to the logs, posing a significant security risk. Azure DevOps users utilizing affected Renovate versions should prioritize upgrading to version 23.25.1 and immediately revoke and regenerate any potentially compromised credentials.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.