CVE-2020-7654

Vulnerability

Overview snyk-broker, a package that proxies access between Snyk and Git repositories, is vulnerable to Information Exposure. Affected versions prior to 4.73.1 log private keys when the logging level is set to DEBUG [1][2]. This occurs because the broker's logging mechanism inadvertently outputs sensitive credential data under verbose logging conditions.

Exploitation

To exploit this, an attacker would need access to the broker's logs or the ability to enable DEBUG logging (e.g., through configuration changes). The vulnerability does not require network-level attacks, but rather local log access or privilege escalation to modify logging settings.

Impact

Successful exploitation leads to exposure of private keys, which could compromise the security of connected Git repositories and Snyk integrations. An attacker with these keys could impersonate the broker, access repositories, or intercept communications.

Mitigation

The issue is fixed in version 4.73.1 [2]. Users should upgrade immediately and avoid running DEBUG logging in production environments.