Is CVE-2020-7653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-7653 being exploited in the wild.

How severe is CVE-2020-7653?

Low severity, with a CVSS score of 3.1, published 3 June 2020.

Which products and versions are affected?

snyk-broker (npm) SEMVER:introduced=0,fixed=4.80.0.

Is there a fix for CVE-2020-7653?

Yes. snyk-broker (npm): upgrade to 4.80.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-7653 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2020-7653?

Check whether you run snyk-broker (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-7653: Snyk Broker arbitrary file read via symlink

CVE-2020-7653 · Severity: low · CVSS 3.1 · Published 2020-06-03

Snyk Broker is a proxy service that securely connects Snyk's security scanning platform to Git repositories and internal systems. The vulnerability allows users with access to Snyk's internal network to read arbitrary files on the broker's host system by exploiting symlink handling in path validation. An attacker could expose sensitive configuration files, credentials, or other confidential data stored on the broker server.

Technologies: snyk-broker (npm). Vendors: npm.

Quick answers

Is CVE-2020-7653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-7653 being exploited in the wild.
How severe is CVE-2020-7653?: Low severity, with a CVSS score of 3.1, published 3 June 2020.
Which products and versions are affected?: snyk-broker (npm) SEMVER:introduced=0,fixed=4.80.0.
Is there a fix for CVE-2020-7653?: Yes. snyk-broker (npm): upgrade to 4.80.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7653 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2020-7653?: Check whether you run snyk-broker (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snyk-broker (npm): upgrade to 4.80.0 or later
```
npm install snyk-broker@4.80.0
```

Technical details

This is a path traversal / symlink attack vulnerability (CWE-59) in Snyk Broker's file access validation. The root cause is insufficient validation of symlinks when checking against whitelisted paths—attackers can create symlinks pointing to arbitrary locations that match whitelisted path patterns, allowing reads of files outside intended scope. The attack requires network access to Snyk's internal infrastructure and elevated privileges (Privileges Required: High), meaning the attacker must already have authenticated access to the Broker. By crafting symlink-based requests, an attacker can achieve complete information disclosure (Confidentiality: High) of files accessible to the Broker process, but cannot modify files or impact availability. The vulnerability was patched in version 4.80.0.

Affected products

Snyk snyk-broker < 4.80.0

Identifiers

CVE-2020-7653
GHSA-4vj3-f849-5r48

Timeline

2020-05-28: disclosed
2020-06-03: patched: Fixed in version 4.80.0
2020-06-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.