Executive brief
Replit's crosis library is used by developers to programmatically connect to and control code environments (Repls) hosted on the Replit platform. When WebSocket connections fail, the library falls back to an older polling proxy address that is no longer under Replit's control; an attacker intercepting this communication could steal authentication tokens and fully compromise the target Repl environment.
Technical details
The vulnerability is an information exposure (CWE-200) affecting the @replit/crosis npm library. When multiple failed WebSocket connection attempts occur during programmatic communication with Replit, the library defaults to a fallback poll-based proxy using an outdated URL. The proxy address has been moved to a new location, and the old address could potentially be controlled by an attacker. No authentication is required by an attacker; they only need to intercept network traffic to the stale proxy endpoint. Successful exploitation allows theft of the connection token, leading to full compromise of the targeted Repl (though not the user's account). The vulnerability was patched in version 7.3.1 by updating the proxy address to gp-v2.replit.com.
Affected products
- Replit crosis before 7.3.1
Timeline
- 2022-01-10: disclosed: GitHub Security Advisory published
- 2022-01-12: patched: Version 7.3.1 released with fix