CVE-2020-7652: 
JavaScript vulnerability analysis and mitigation

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read vulnerability (CVE-2020-7652). The vulnerability was discovered and disclosed on May 28, 2020, affecting the snyk-broker package, which is used to proxy access between snyk.io and Git repositories such as GitHub Enterprise, GitHub.com, and Bitbucket Server (Snyk Vuln).

The vulnerability allows arbitrary file reads for users with access to Snyk's internal network by renaming files to match whitelisted paths. The vulnerability has a CVSS v3.1 base score of 6.5 (Medium), with high impact on confidentiality but no impact on integrity and availability. The attack vector is network-based, with low attack complexity, requiring high privileges and no user interaction (Snyk Vuln).

The vulnerability can result in a total loss of confidentiality, allowing attackers to access restricted information that could present a direct, serious impact. The vulnerability specifically affects users with access to Snyk's internal network (Snyk Vuln).

Snyk has confirmed the existence of a proof-of-concept or detailed explanation of how to exploit this vulnerability. The EPSS (Exploit Prediction Scoring System) indicates a 0.13% probability (50th percentile) of exploitation in the wild (Snyk Vuln).

The vulnerability has been patched in version 4.80.0 of snyk-broker. Users should upgrade to version 4.80.0 or higher to resolve the issue. Additionally, Snyk has improved the auditability of the Broker code and enhanced both client and server-side logging to improve customer and Snyk visibility of service activity (Snyk Updates).

The vulnerability was responsibly disclosed by Wing Chan of The Hut Group through Snyk's bug bounty program. The issues were related to increased privileges available to specific internal Snyk Personnel only (Snyk Updates).