CVE-2020-7653

Vulnerability

Overview

Snyk Broker, a package that proxies access between Snyk.io and Git repositories, is vulnerable to an arbitrary file read in versions before 4.80.0 [1][2]. The root cause is that the broker does not properly validate file paths when processing requests, allowing an attacker to create symbolic links (symlinks) that point to arbitrary files on the system.

Exploitation

To exploit this vulnerability, an attacker must have access to Snyk's internal network. By creating a symlink that matches a whitelisted path, the attacker can trick the broker into reading files outside the intended directory. This bypasses the path whitelisting mechanism, enabling access to sensitive files.

Impact

Successful exploitation allows an attacker to read arbitrary files on the broker server. This could include configuration files, credentials, or other sensitive data that may lead to further compromise of the system or connected services.

Mitigation

The vulnerability is fixed in snyk-broker version 4.80.0. Users should upgrade to this version or later to protect against arbitrary file reads [1][2]. No workarounds are known.