CVE-2024-29042 Translate Cache Poisoning Vulnerability
An attacker can poison the translation cache to serve malicious or incorrect translations to other users by manipulating the cache key.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29042?
CVE-2024-29042 is a medium-severity vulnerability in franciscop translate, published on 22 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. Version 3.0.0 fixes this issue.
Weakness: CWE-20
Which versions are affected by CVE-2024-29042?
2 open source packages ship an affected version, including translate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
translate npm | All versions | 3.0.0 |
translate npm | All versions | 3.0.0 |
Products include Francisco Translate.
How do I fix CVE-2024-29042?
Upgrade translate to 3.0.0 or later.
Is CVE-2024-29042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29042 exists.
Sources
Also known as GHSA-882j-4vj5-7vmj.