Executive brief
Snyk Broker is a tool that securely connects Snyk's cloud service to on-premise Git repositories and Jira deployments. A vulnerability in versions before 4.72.2 allows users with internal network access to read arbitrary files by manipulating URLs with fragment identifiers, potentially exposing sensitive configuration files or credentials stored on the broker server.
Technical details
The vulnerability is a path traversal issue (CWE-22) in Snyk Broker versions below 4.72.2. An authenticated attacker with access to Snyk's internal network can exploit this by appending a URL fragment identifier followed by a whitelisted path (e.g., #package.json) to bypass access controls and read arbitrary files on the broker instance. The vulnerability requires high privileges (internal network access) but no user interaction. An attacker can achieve full confidentiality compromise by reading sensitive files. The fix is to upgrade to version 4.72.2 or later.
Affected products
- Snyk Broker before 4.72.2
Timeline
- 2020-05-28: disclosed
- 2020-06-03: patched: Version 4.72.2 released