CVE-2020-7650

Vulnerability

The snyk-broker package, used to proxy access between Snyk and Git repositories (e.g., GitHub, Bitbucket), is vulnerable to arbitrary file read in versions 4.72.0 through 4.73.0. The vulnerability specifically targets files with extensions .yaml, .yml, or .json, allowing unauthorized access to these files on Snyk's internal network. The root cause is insufficient access controls when the broker processes file requests from users with network-level access.

Exploitation

An attacker with access to Snyk's internal network can exploit this vulnerability by crafting requests that read arbitrary files with the specified extensions. No authentication beyond network access is required. The attack surface is limited to internal network users, but such access could be obtained through other means (e.g., compromised credentials or network intrusion).

Impact

Successful exploitation enables an attacker to read sensitive configuration files (e.g., YAML, JSON) that may contain credentials, API keys, or other secrets. This could lead to further compromise of Snyk services or connected resources, such as Git repositories and Jira deployments.

Mitigation

The vulnerability is fixed in snyk-broker version 4.73.1 and later. Users should upgrade immediately to protect their environments. No workarounds are available. [1][2]