Quick answers
- Is CVE-2020-7648 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-7648 being exploited in the wild.
- How severe is CVE-2020-7648?
- Low severity, with a CVSS score of 3.1, published 3 June 2020.
- Which products and versions are affected?
- snyk-broker (npm) SEMVER:introduced=0,fixed=4.72.2; Snyk Broker before 4.72.2.
- Is there a fix for CVE-2020-7648?
- Yes. snyk-broker (npm): upgrade to 4.72.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-7648 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2020-7648?
- Check whether you run snyk-broker (npm) or Snyk Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- snyk-broker (npm): upgrade to 4.72.2 or later
npm install snyk-broker@4.72.2
Technical details
The vulnerability is a path traversal issue (CWE-22) in Snyk Broker versions below 4.72.2. An authenticated attacker with access to Snyk's internal network can exploit this by appending a URL fragment identifier followed by a whitelisted path (e.g., #package.json) to bypass access controls and read arbitrary files on the broker instance. The vulnerability requires high privileges (internal network access) but no user interaction. An attacker can achieve full confidentiality compromise by reading sensitive files. The fix is to upgrade to version 4.72.2 or later.
Affected products
- Snyk Broker before 4.72.2
Identifiers
- CVE-2020-7648
- GHSA-9xv2-548x-5h79
Timeline
- 2020-05-28: disclosed
- 2020-06-03: patched: Version 4.72.2 released