Executive brief
dectalk-tts is a Node.js text-to-speech library that makes network requests to a third-party API. The library sent these requests over unencrypted HTTP instead of HTTPS, allowing attackers on the network to intercept and modify the traffic. An attacker could eavesdrop on user input, steal sensitive data if sent to the API, or inject malicious audio files into the application's output, potentially compromising the user's system.
Technical details
The vulnerability is a cleartext transmission issue (CWE-319) where dectalk-tts version 1.0.0 made unencrypted HTTP requests to a third-party text-to-speech API instead of using HTTPS. The attack vector is network-based with no authentication or user interaction required; any attacker positioned to observe network traffic (e.g., on the same network, via DNS spoofing, or BGP hijacking) can perform a man-in-the-middle (MITM) attack. An attacker can intercept API requests to steal user input, modify API responses to return malicious WAV-encoded audio files that may exploit file handling vulnerabilities, or interfere with service availability. The vulnerability was patched in version 1.0.1 by upgrading to HTTPS; users should update immediately as the fix involves no breaking changes.
Affected products
- npm dectalk-tts 1.0.0
Timeline
- 2024-04-04: disclosed
- 2024-04-04: patched: Patched in version 1.0.1