From d2afc2a60298a3fd88d23851812f454a1e95cd87 Mon Sep 17 00:00:00 2001 From: vscode Date: Wed, 22 Jul 2026 09:35:15 +0000 Subject: [PATCH 1/2] docs(renovate): add renovate bots guidance --- docs/guides/renovate.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/guides/renovate.md b/docs/guides/renovate.md index c37abf33..e3b351e8 100644 --- a/docs/guides/renovate.md +++ b/docs/guides/renovate.md @@ -55,6 +55,18 @@ Quick examples (filter value -> example bypass path): - `V3`: `/acme-org\/infra/` -> `evil-acme-org/infra-test` - `V4`: `/^acme-org/` -> `acme-org-evil/x` +### Identify Renovate Bots Directly + +Use the `bots` command to identify Renovate bot users directly, even if the target instance has little or no visible Renovate configuration. + +```bash +pipeleek gl renovate bots -u https://gitlab.com -t glpat-[redacted] +``` + +This command is useful when `renovate enum` returns no results, for example when configuration files were deleted or are not accessible to your token. + +If no Renovate configs are found, blind exploitation might still work: identify a likely Renovate bot user, invite it to your repository, and hope it is misconfigured and processes your project. + ## 2. Exploit Autodiscovery with a Malicious Project The Renovate bot from the example above is configured to autodiscover new projects and does not apply any, or only weak, bypassable filters. You can create a repository with a malicious script that gets executed by the bot. From bf228077c5ed3333105e832ce7a14b7db664dc94 Mon Sep 17 00:00:00 2001 From: frjcomp <107982661+frjcomp@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:44:34 +0200 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/guides/renovate.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/renovate.md b/docs/guides/renovate.md index e3b351e8..38b98653 100644 --- a/docs/guides/renovate.md +++ b/docs/guides/renovate.md @@ -63,7 +63,7 @@ Use the `bots` command to identify Renovate bot users directly, even if the targ pipeleek gl renovate bots -u https://gitlab.com -t glpat-[redacted] ``` -This command is useful when `renovate enum` returns no results, for example when configuration files were deleted or are not accessible to your token. +This command is useful when `pipeleek gl renovate enum` returns no results, for example when configuration files were deleted or are not accessible to your token. If no Renovate configs are found, blind exploitation might still work: identify a likely Renovate bot user, invite it to your repository, and hope it is misconfigured and processes your project.