Dependabot
Last updated
Last updated
Dependabot uses Github Actions and separate environment to run the checks. There are several public resources that can be helpful to review internal implementation details:
dependabot/updater-action action that is responsible for running Dependabot updates.
dependabot/dependabot-core action that is implemented core logic. Check out the architecture of dependabot-core.
dependabot-updater is a Docker image that launches scanning (includes dependabot-core as a component).
dependabot-update-job-proxy a Docker image with proxy that authenticates requests to certain Github API endpoints and allows dependabot not to disclose Github API token.
Dependabot is able to gather information about dependencies from the manifests, such as setup.py or .gemspec, which can be abused to execute an arbitrary code. Package managers with the package-ecosystem values bundler, mix, and pip can be abused to execute external code in the manifest as part of the version update process. Therfore, if you can poison the manifest, you can execute an arbitrary code while Dependabot is running.
Check how to abuse manifests to gain code execution in the Parameters Injection page
Dependabot allows developers to prevent code execution by setting insecure-external-code-execution to deny. Moreover, Dependabot automatically sets insecure-external-code-execution to deny and prevents external code execution when a registries setting is used within an updates configuration. However, it may cause the version update to fail, so developers can override this behaviour by setting insecure-external-code-execution to allow and allow code execution.
If Dependabot detects non-updated dependencies, it will create a PR to bump versions of those dependencies. Dependabot adds an additional information about changes, which may contain release notes and a list of commits with missages. You can find an example of such PR in the following screenshot:
However, Dependabot supports private dependencies and it will add this data to a PR for a private dependency as well. Therefore, if a public project has private dependencies, Dependabot will disclose release notes and commits of those projects.