Executive brief
Snyk Broker is a proxy service that securely connects Snyk's security scanning platform to Git repositories and internal systems. The vulnerability allows users with access to Snyk's internal network to read arbitrary files on the broker's host system by exploiting symlink handling in path validation. An attacker could expose sensitive configuration files, credentials, or other confidential data stored on the broker server.
Technical details
This is a path traversal / symlink attack vulnerability (CWE-59) in Snyk Broker's file access validation. The root cause is insufficient validation of symlinks when checking against whitelisted paths—attackers can create symlinks pointing to arbitrary locations that match whitelisted path patterns, allowing reads of files outside intended scope. The attack requires network access to Snyk's internal infrastructure and elevated privileges (Privileges Required: High), meaning the attacker must already have authenticated access to the Broker. By crafting symlink-based requests, an attacker can achieve complete information disclosure (Confidentiality: High) of files accessible to the Broker process, but cannot modify files or impact availability. The vulnerability was patched in version 4.80.0.
Affected products
- Snyk snyk-broker < 4.80.0
Timeline
- 2020-05-28: disclosed
- 2020-06-03: patched: Fixed in version 4.80.0
- 2020-06-03: advisory