CVE-2020-7652

Vulnerability

Overview Snyk Broker versions prior to 4.80.0 are vulnerable to an arbitrary file read issue. The broker proxies requests between Snyk.io and private Git repositories, running inside the user's internal network. The vulnerability stems from improper handling of file paths, enabling an attacker to rename files to match whitelisted paths and bypass access controls [1][2].

Exploitation

An attacker must have access to Snyk's internal network to exploit this vulnerability. By crafting requests that traverse directories (e.g., using ../ sequences), the attacker can read arbitrary files from the broker's host filesystem. The broker's whitelist of allowed paths can be circumvented by renaming files to appear as though they belong to permitted directories [2].

Impact

Successful exploitation allows an attacker to read sensitive files on the broker system, including configuration files, credentials, or other data accessible to the broker process. This could lead to further compromise of the internal network or exposure of secrets used to connect to Git repositories [1][2].

Mitigation

The vulnerability is patched in version 4.80.0 of snyk-broker. Users should upgrade immediately to this or a later version. No workarounds have been documented, but restricting network access to the broker can reduce exposure [2].