Executive brief
A vulnerability in a popular Google Translate integration library could allow attackers to redirect internal network requests. If an application using this library allows users to specify translation settings, an attacker could trick the server into connecting to private internal systems instead of Google's servers. This could lead to unauthorized access to internal services or data that is not intended to be exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the google-translate-api-browser npm package due to improper validation of the 'tld' field within the translateOptions object. An attacker can provide a malicious top-level domain (TLD) value, such as '@127.0.0.1', which manipulates the final request URL to point toward local or internal resources instead of the legitimate Google Translate API. This occurs because the library fails to sanitize the TLD input before concatenating it into the request string. Exploitation requires the host application to expose these translation options to end-user input. The issue is fixed in version 4.1.3.
Affected products
- cjvnjde google-translate-api-browser < 4.1.3
Timeline
- 2023-11-23: advisory: GitHub Security Advisory published
- 2023-11-24: disclosed: NVD publication date