CVE-2020-7651: 
JavaScript vulnerability analysis and mitigation

All versions of snyk-broker before 4.79.0 were affected by a security vulnerability identified as CVE-2020-7651. The vulnerability was discovered by Wing Chan of The Hut Group and was disclosed on May 28, 2020, with a public release on May 29, 2020. Snyk-broker is a package that proxies access between snyk.io and Git repositories, such as GitHub Enterprise, GitHub.com and Bitbucket Server, as well as on-premise Jira deployments (Snyk Advisory).

The vulnerability is classified as an Arbitrary File Read vulnerability with a CVSS v3.1 score of 4.9 (Medium). The vulnerability allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API. The attack vector is network-based with low attack complexity, requiring high privileges but no user interaction (Snyk Advisory).

The vulnerability results in a total loss of confidentiality within the impacted component, potentially allowing attackers to access restricted information that could present a direct, serious impact. However, there is no reported impact on system integrity or availability (Snyk Advisory).

The vulnerability is exploitable over the network with low attack complexity, though it requires high privileges. Snyk has confirmed the existence of a proof-of-concept or detailed explanation of how to exploit this vulnerability. The EPSS (Exploit Prediction Scoring System) indicates a 0.09% probability of exploitation (41st percentile) (Snyk Advisory).

The vulnerability was patched in version 4.79.0 of snyk-broker. Users are advised to upgrade to version 4.79.0 or higher to address this security issue. Additionally, Snyk has implemented improvements to the auditability of the Broker code and enhanced both client and server-side logging to improve customer and Snyk visibility of activity on the service (Snyk Updates).

The vulnerability was responsibly disclosed through Snyk's bug bounty program by Wing Chan of The Hut Group. Snyk acknowledged the disclosure and responded by implementing security fixes for all supported SCMs in version 4.80.0 of the Broker (Snyk Updates).