CVE-2024-31206 Use of Unencrypted HTTP Request in dectalk-tts
Attackers can intercept and modify unencrypted HTTP traffic in the dectalk-tts library, enabling man-in-the-middle attacks against users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-31206?
CVE-2024-31206 is a high-severity vulnerability in JstnMcBrd dectalk-tts, published on 4 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `[email protected]`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.
Which versions are affected by CVE-2024-31206?
2 open source packages ship an affected version, including dectalk-tts.
| Package | Affected | Fixed in |
|---|---|---|
dectalk-tts npm | From 1.0.0 | 1.0.1 |
dectalk-tts npm | From 1.0.0 | 1.0.1 |
How do I fix CVE-2024-31206?
Upgrade dectalk-tts to 1.0.1 or later.
Is CVE-2024-31206 being exploited?
There is no known exploitation of CVE-2024-31206 in the wild and no public exploit code.
Sources
Also known as GHSA-6cf6-8hvr-r68w.