PT-2022-15025 · Replit · @Replit/Crosis

Orlserg · Published 2022-01-11 · Updated 2023-07-24 · CVE-2022-21671

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions @replit/crosis versions prior to 7.3.1

Description A vulnerability exists that involves exposure of sensitive information. When using the library to communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy. The URL of the proxy has changed, so any communication done to the previous URL could potentially reach a server that is outside of Replit's control and the token used to connect to the Repl could be obtained by an attacker, leading to full compromise of that Repl.

Recommendations For versions prior to 7.3.1, update to version 7.3.1 or later. As a temporary workaround, specify the new address for the polling host (gp-v2.replit.com) in the ConnectArgs.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-21671

GHSA-7W54-GP8X-F33M

Affected Products

@Replit/Crosis

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21671.json · Exploit
• https://github.com/replit/crosis/commit/e44b6a8f5fa28cb2872e3c19bb8a205bb5bfc281 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21671 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21671 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7w54-gp8x-f33m · Vendor Advisory
• https://github.com/replit/crosis/security/advisories/GHSA-7w54-gp8x-f33m · Note
• https://github.com/replit/crosis · Note
• https://t.me/cibsecurity/35248 · Telegram Post