cjvnjde google-translate-api-browser up to 4.1.2 Web API server-side request forgery

Summaryinfo

A vulnerability labeled as critical has been found in cjvnjde google-translate-api-browser up to 4.1.2. This affects an unknown part of the component Web API. Such manipulation leads to server-side request forgery. This vulnerability is documented as CVE-2023-48711. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in cjvnjde google-translate-api-browser up to 4.1.2 (Automation Software). Affected by this issue is an unknown part of the component Web API. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is integrity. CVE summarizes:

google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the `google-translate-api-browser` package and exposing the `translateOptions` to the end user. An attacker can set a malicious `tld`, causing the application to return unsafe URLs pointing towards local resources. The `translateOptions.tld` field is not properly sanitized before being placed in the Google translate URL. This can allow an attacker with control over the `translateOptions` to set the `tld` to a payload such as `@127.0.0.1`. This causes the full URL to become `https://[email protected]/...`, where `translate.google.` is the username used to connect to localhost. An attacker can send requests within internal networks and the local host. Should any HTTPS application be present on the internal network with a vulnerability exploitable via a GET call, then it would be possible to exploit this using this vulnerability. This issue has been addressed in release version 4.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was released 11/24/2023 as GHSA-4233-7q5q-m7p6. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-48711 since 11/17/2023. There are neither technical details nor an exploit publicly available.

Upgrading to version 4.1.3 eliminates this vulnerability. Applying the patch 33c2eac4a21c6504409e7b06dd16e6346f93d34b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• cjvnjde

Name

• google-translate-api-browser

Version

• 4.1.0
• 4.1.1
• 4.1.2

License

• open-source

Website

• Product: https://github.com/cjvnjde/google-translate-api-browser/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion