CVE-2024-31206: 
JavaScript vulnerability analysis and mitigation

CVE-2024-31206 affects dectalk-tts, a Node package designed to interact with the aeiou Dectalk web API. The vulnerability was discovered in version 1.0.0 of the package, where network requests to the third-party API were being sent over unencrypted HTTP. This security issue was disclosed and patched in February 2024 (GitHub Advisory).

The vulnerability stems from using unencrypted HTTP protocol for API requests in the package's source code. The issue was identified in version 1.0.0, specifically in the URL construction where 'http://tts.cyzon.us/tts' was used instead of its secure HTTPS counterpart. The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. The vulnerability is associated with multiple CWE categories: CWE-319 (Cleartext Transmission of Sensitive Information), CWE-300 (Channel Accessible by Non-Endpoint), and CWE-598 (Use of GET Request Method With Sensitive Query Strings) (GitHub Advisory).

The vulnerability exposes users to potential man-in-the-middle (MITM) attacks where unencrypted traffic can be intercepted and modified by attackers. While the package is primarily designed for text-to-speech conversion of natural language, any sensitive information transmitted could be stolen. Additionally, attackers could manipulate API responses, potentially returning malicious output that could affect the user's filesystem when saved as audio files (GitHub Advisory).

The vulnerability is easily exploitable due to its network-based attack vector, low attack complexity, and no required privileges or user interaction. The unencrypted HTTP traffic can be intercepted by any attacker positioned between the client and the API server (GitHub Advisory).

The vulnerability has been patched in version 1.0.1 by upgrading the network request to use HTTPS instead of HTTP. Users should update to this version as there are no effective workarounds. For those who cannot immediately update, precautions include not sending any sensitive information and carefully verifying API responses before saving them (GitHub Advisory, GitHub PR).

The vulnerability was initially reported as an issue on GitHub, leading to prompt action from the package maintainers who created a pull request to fix the issue. The fix was quickly merged and a new secure version was released (GitHub Issue).