I have a question regarding this vulnerability. I’d like to know what this actually means.. Is it just some fantasy of a github dependabot, or maybe it is really sth dangerous in the real life.
here’s some overview about the issue

https://github.com/advisories/GHSA-xwcq-pm8m-c4vf

Could someone please explaing to me… if I use it to encrypt my crypto private keys, will someone be able to decrypt them ( without knowing my password of course ). Could you please explain in a simple manner what’s this vulnerability in reality.

here’s the code for the hackers:)

export const encryptPrivateKey = (privateKey: string, password: string) => {
    const privateKeyBytes = CryptoJS.enc.Hex.parse(privateKey);
    const key = CryptoJS.PBKDF2(password, CryptoJS.SHA256(password), { keySize: 256 / 32 });
    const ciphertext = CryptoJS.AES.encrypt(privateKeyBytes, key, { mode: CryptoJS.mode.ECB });

    return String(ciphertext);
};

and the decrypt one

const getDecryptedBytes = (_encBase64Pk: string, _pwd: string) => {
    const salt = CryptoJS.SHA256(_pwd);
    const key = CryptoJS.PBKDF2(_pwd, salt, { keySize: 256 / 32 });
    return CryptoJS.AES.decrypt(_encBase64Pk, key, { mode: CryptoJS.mode.ECB });
};

export const decryptPrivateKey = (_encBase64Pk: string, _pwd: string) => {
    const decryptedBytes = getDecryptedBytes(_encBase64Pk, _pwd);
    const decryptedHex = decryptedBytes.toString(CryptoJS.enc.Hex);
    if (decryptedHex[0] == decryptedHex[1] && +decryptedHex[0] == 0) {
        const decrypt = decryptedHex.substring(0, 1) + 'x' + decryptedHex.substring(2);
        return decrypt;
    }
    return decryptedHex;
};

and here’s the decrypted private key
sEf9jM/BCXfQ94758EMFGcru3jut3U2vKhcZlyqL7xTU+/eeBkoJsQoiKQ6XQm0i

Will you be able to get the raw private key>

Thanks a lot!