Renovate Allowlist Bypass via Shared Presets

Renovate before version 44.60.1 contains a vulnerability that allows repository users to evade 'allowedHeaders' restrictions. By leveraging the way Renovate handles shared presets, an attacker can supply internal or externally sourced presets containing unvalidated 'hostRules[].headers'. When processed, these presets allow the injection of custom HTTP headers into requests that the Renovate application sends to external hosts. This vulnerability is significant as it permits the redirection of sensitive authentication tokens or credentials to attacker-controlled infrastructure, or the manipulation of requests to downstream services, potentially leading to unauthorized data exposure. Organizations utilizing Renovate for dependency management should prioritize upgrading to version 44.60.1 or later to mitigate this risk.

Impact

Successful exploitation allows repository users to bypass security controls by injecting arbitrary headers into outbound requests made by the Renovate service. This can lead to unauthorized data exposure, potential credential theft via header manipulation, and the ability to influence requests directed at third-party hosts within the supply chain infrastructure.

Recommendation

• Upgrade all instances of Renovate to version 44.60.1 or later immediately.
• Audit existing shared presets for the presence of unauthorized or suspicious 'hostRules' blocks, specifically inspecting the 'headers' property for non-standard or external destination domains.
• Implement stricter egress filtering for the Renovate service to prevent connections to unauthorized external hosts if header injection is attempted.