Description
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| renovatebot | renovate | < 44.11.3 | 44.11.3 |
| mend | renovate-ce | < 15.4.0 | 15.4.0 |
| mend | renovate-ee-server | < 15.4.0 | 15.4.0 |
| mend | renovate-ee-worker | < 15.4.0 | 15.4.0 |
| mend | mend-renovate-ce | < 15.4.0 | 15.4.0 |
| mend | mend-renovate-enterprise-edition | < 10.4.0 | 10.4.0 |
References
- GitHub Security Advisory (GHSA-9hmg-9h89-jhmx) vendor-advisory
- VulnCheck Advisory: Renovate before 44.11.3 Credential Exfiltration via Link Header third-party-advisory