Summary
Renovate contains a server-side request forgery vulnerability in its shared HTTP client. A user who can influence an extends preset or custom datasource may cause requests to arbitrary internal URLs, potentially exposing cloud metadata credentials or sensitive responses through Renovate logs.
Renovate contains a server-side request forgery vulnerability in its shared HTTP client. A user who can influence an extends preset or custom datasource may cause requests to arbitrary internal URLs, potentially exposing cloud metadata credentials or sensitive responses through Renovate logs.
Affected context
The vulnerability occurs in Renovate deployments where user-controlled or insufficiently trusted configuration can define extends presets or custom datasources. The risk is greater when the shared HTTP client can reach internal services, cloud instance metadata endpoints, or other sensitive network locations, and when returned content may be written to accessible logs.
The vulnerability occurs in Renovate deployments where user-controlled or insufficiently trusted configuration can define extends presets or custom datasources. The risk is greater when the shared HTTP client can reach internal services, cloud instance metadata endpoints, or other sensitive network locations, and when returned content may be written to accessible logs.
Exploit preconditions
- Attack surface: Renovate configuration fields that influence preset or custom datasource URLs
- Required access: Ability to submit, modify, or cause processing of affected Renovate configuration
- Trigger point: HTTP requests made while resolving presets or retrieving custom datasource content
- Why exploitation is possible: The shared client may follow attacker-influenced destinations without adequately restricting access to internal or sensitive network addresses
- Attack surface: Renovate configuration fields that influence preset or custom datasource URLs
- Required access: Ability to submit, modify, or cause processing of affected Renovate configuration
- Trigger point: HTTP requests made while resolving presets or retrieving custom datasource content
- Why exploitation is possible: The shared client may follow attacker-influenced destinations without adequately restricting access to internal or sensitive network addresses
Why this happens
The underlying issue is insufficient destination validation and network egress control for requests derived from configuration. This maps to CWE-918: Server-Side Request Forgery, where server-side functionality can be influenced to send requests to attacker-selected resources, including services that are inaccessible from the attacker's own network. Logging of response content can further expose data obtained from those requests.
The underlying issue is insufficient destination validation and network egress control for requests derived from configuration. This maps to CWE-918: Server-Side Request Forgery, where server-side functionality can be influenced to send requests to attacker-selected resources, including services that are inaccessible from the attacker's own network. Logging of response content can further expose data obtained from those requests.
Potential impact
- Access to internal services that trust requests from the Renovate environment
- Disclosure of cloud instance metadata or temporary credentials
- Exposure of sensitive response data through Renovate logs
- Internal network reconnaissance
- Potential compromise of connected cloud or deployment resources
- Access to internal services that trust requests from the Renovate environment
- Disclosure of cloud instance metadata or temporary credentials
- Exposure of sensitive response data through Renovate logs
- Internal network reconnaissance
- Potential compromise of connected cloud or deployment resources
General mitigation guidance
Mitigation generally focuses on reducing trust in configuration-derived URLs and enforcing explicit network boundaries.
Common defensive patterns include:
- Applying allowlists for permitted schemes, hosts, ports, and destinations
- Blocking loopback, link-local, private, and cloud metadata address ranges where they are not required
- Revalidating destinations after DNS resolution and across redirects
- Restricting outbound network access from Renovate using egress policies or network segmentation
- Avoiding sensitive response-body logging and applying appropriate log redaction
- Running Renovate with only the credentials and network privileges it needs
Mitigation generally focuses on reducing trust in configuration-derived URLs and enforcing explicit network boundaries.
Common defensive patterns include:
- Applying allowlists for permitted schemes, hosts, ports, and destinations
- Blocking loopback, link-local, private, and cloud metadata address ranges where they are not required
- Revalidating destinations after DNS resolution and across redirects
- Restricting outbound network access from Renovate using egress policies or network segmentation
- Avoiding sensitive response-body logging and applying appropriate log redaction
- Running Renovate with only the credentials and network privileges it needs
How teams detect issues like this
Organizations can look for SSRF risks through:
- Static analysis of HTTP client calls whose destinations originate from configuration or user-controlled data
- Code review checks for missing URL validation, redirect validation, and private-address filtering
- Network monitoring for requests from Renovate to metadata services, loopback addresses, private ranges, or unexpected external hosts
- Log analysis for unusual datasource targets and sensitive response content
- Policy enforcement requiring outbound allowlists and restricted runtime network access
Automated security review tools can help identify unvalidated URL construction and server-side request paths.
Organizations can look for SSRF risks through:
- Static analysis of HTTP client calls whose destinations originate from configuration or user-controlled data
- Code review checks for missing URL validation, redirect validation, and private-address filtering
- Network monitoring for requests from Renovate to metadata services, loopback addresses, private ranges, or unexpected external hosts
- Log analysis for unusual datasource targets and sensitive response content
- Policy enforcement requiring outbound allowlists and restricted runtime network access
Automated security review tools can help identify unvalidated URL construction and server-side request paths.
