CVE-2022-21671: Potential exposure of tokens to an Unauthorized Actor in @replit/crosis
Summary
CVE-2022-21671: Potential exposure of tokens to an Unauthorized Actor. Affects @replit/crosis versions < 7.3.1. Fixed in 7.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @replit/crosis package is an open-source library used for programmatically communicating with Replit, a cloud-based coding platform. It provides functionalities for interacting with Replit's services through WebSocket connections. However, a vulnerability has been identified in versions prior to 7.3.1 that could potentially expose tokens to an unauthorized actor.
Vulnerability Detail
The vulnerability arises when there are multiple failed attempts to contact Replit through a WebSocket. In such cases, the library falls back to using a poll-based proxy. However, the URL of the proxy has changed, and any communication done to the previous URL may reach a server outside of Replit's control. This exposes the token used to connect to the Repl, allowing an attacker to obtain it and potentially compromise the affected Repl. It's important to note that this vulnerability does not impact the entire Replit account, but only the specific Repl.
How To Fix
Minimum fixed version
7.3.1
This is the first release that contains the fix.
npm install @replit/crosis@7.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround can be implemented by specifying the new address for the polling host (gp-v2.replit.com) in the ConnectArgs when connecting to Replit. Here's an example in TypeScript:
const connectOptions: ConnectArgs = {
// ...
pollingHost: 'gp-v2.replit.com',
};
client.connect(connectOptions);
Conclusion
The @replit/crosis package prior to version 7.3.1 is vulnerable to potential token exposure to an unauthorized actor. To mitigate this vulnerability, it is crucial to update the package to version 7.3.1 or later. Alternatively, a workaround can be implemented by specifying the new polling host address. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @replit/crosis →
FAQ
The impact of this vulnerability is that an unauthorized actor could potentially obtain the token used to connect to a Repl, leading to the full compromise of that specific Repl. However, it does not affect the entire Replit account.
The vulnerability was patched in version 7.3.1 of the @replit/crosis package. The patch updated the address of the fallback WebSocket polling proxy to ensure secure communication within Replit's control.
Yes, a workaround is available by specifying the new address for the polling host (gp-v2.replit.com) in the ConnectArgs when connecting to Replit. This can be done while using versions prior to 7.3.1 of the @replit/crosis package.
This vulnerability was discovered and disclosed by orlserg through HackerOne.
For more information, you can open an issue in the replit/crosis GitHub repository or email security@replit.com.
