CVE-2020-7650: Snyk Broker arbitrary file read via path traversal

CVE-2020-7650 · Severity: low · CVSS 3.1 · Published 2020-06-03

Snyk Broker is a proxy service used to securely connect Snyk's scanning tools to private code repositories and internal systems like Jira. A security flaw in certain versions allows users with access to the internal network to read sensitive configuration or data files ending in .yaml, .yml, or .json. This could lead to the exposure of credentials, system configurations, or other sensitive business information stored in those file formats.

Technologies: snyk-broker (npm), Snyk Broker. Vendors: npm, Snyk.

Quick answers

Is CVE-2020-7650 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-7650 being exploited in the wild.
How severe is CVE-2020-7650?
Low severity, with a CVSS score of 3.1, published 3 June 2020.
Which products and versions are affected?
snyk-broker (npm) SEMVER:introduced=0,fixed=4.73.1; Snyk Broker >=4.72.0 <4.73.1.
Is there a fix for CVE-2020-7650?
Yes. snyk-broker (npm): upgrade to 4.73.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7650 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-7650?
Check whether you run snyk-broker (npm) or Snyk Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • snyk-broker (npm): upgrade to 4.73.1 or later
    npm install snyk-broker@4.73.1

Technical details

Snyk Broker versions from 4.72.0 up to (but excluding) 4.73.1 are vulnerable to an arbitrary file read (path traversal) vulnerability, identified as CWE-22. The flaw allows an attacker with network access and low-level privileges to retrieve files from the host system, provided the files have .yaml, .yml, or .json extensions. This is particularly critical as these extensions are commonly used for configuration files containing secrets or environment variables. The vulnerability was addressed in version 4.73.1.

Affected products

  • Snyk snyk-broker >=4.72.0 <4.73.1

Identifiers

  • CVE-2020-7650
  • GHSA-2fmp-7xwf-wvwr

Timeline

  • 2020-05-28: disclosed: Vulnerability disclosed by Wing Chan of The Hut Group.
  • 2020-05-29: advisory: NVD and Snyk published advisory details.
  • 2020-06-03: advisory: GitHub Advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.