CVE-2023-48711: Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browser
Summary
CVE-2023-48711: google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability. Affects google-translate-api-browser versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The google-translate-api-browser package is an npm package used for translating text using the Google Translate API. It provides a convenient way to generate translation URLs and handle the responses. The package is commonly used in Node.js applications to integrate translation functionality. However, a vulnerability has been discovered in the package that allows for Server-Side Request Forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability arises from the improper sanitization of the translateOptions.tld field before being used in the Google Translate URL. An attacker can manipulate this field to set a malicious tld, causing the application to generate unsafe URLs pointing towards local resources. By setting the tld to a payload like @127.0.0.1, the generated URL becomes https://translate.google.@127.0.0.1/..., where translate.google. is the username used to connect to localhost. This allows an attacker to send requests within internal networks and the localhost, potentially exploiting vulnerabilities in local applications accessible via GET calls.
How To Fix
Minimum fixed version
4.1.0
This is the first release that contains the fix.
npm install google-translate-api-browser@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to manually sanitize the translateOptions.tld field before passing it to the generateRequestUrl function. This can be done by validating the input against a whitelist of allowed top-level domains (TLDs) or by explicitly disallowing any input containing special characters or IP addresses.
Conclusion
The google-translate-api-browser package is vulnerable to a Server-Side Request Forgery (SSRF) attack due to improper sanitization of user-controlled input. This vulnerability allows an attacker to send requests within internal networks and the localhost, potentially exploiting vulnerabilities in local applications. It is recommended to update the package to version 4.1.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for google-translate-api-browser →
FAQ
The vulnerability allows an attacker to send requests within internal networks and the localhost. If there are any vulnerable HTTPS applications on the internal network that can be exploited via GET calls, this vulnerability can be used to exploit them.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and alerts you in real-time for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 3.7.
There are currently no known exploits of this vulnerability. However, it is important to patch the vulnerability as soon as possible to prevent potential attacks.
Yes, the fix for this vulnerability is to update the google-translate-api-browser package to version 4.1.0 or later.
