CVE-2023-50710 – hono

Package

Manager: npm
Name: hono
Vulnerable Version: >=0 <3.11.7

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS: 0.00362 pctl0.57551

Details

Named path parameters can be overridden in TrieRouter ### Impact The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. The code to reproduce it. The server side application: ```ts import { Hono } from 'hono' import { TrieRouter } from 'hono/router/trie-router' const wait = async (ms: number) => { return new Promise((resolve) => { setTimeout(resolve, ms) }) } const app = new Hono({ router: new TrieRouter() }) app.use('*', async (c, next) => { await wait(Math.random() * 200) return next() }) app.get('/modules/:id/versions/:version', async (c) => { const id = c.req.param('id') const version = c.req.param('version') console.log('path', c.req.path) console.log('version', version) return c.json({ id, version, }) }) export default app ``` The client code which makes requests to the server application: ```ts const examples = [ 'http://localhost:8787/modules/first/versions/first', 'http://localhost:8787/modules/second/versions/second', 'http://localhost:8787/modules/third/versions/third', ] const test = () => { for (const example of examples) { fetch(example) .then((response) => response.json()) .then((data) => { const splitted = example.split('/') const expected = splitted[splitted.length - 1] if (expected !== data.version) { console.error(`Error: exprected ${expected} but got ${data.version} - url was ${example}`) } }) } } test() ``` The results: ```txt Error: exprected second but got third - url was http://localhost:8787/modules/second/versions/second Error: exprected first but got third - url was http://localhost:8787/modules/first/versions/first ``` ### Patches "v3.11.7" includes the change to fix this issue. ### Workarounds Don't use TrieRouter directly. ```ts // DON'T USE TrieRouter import { TrieRouter } from 'hono/router/trie-router' const app = new Hono({ router: new TrieRouter() }) ``` ### References Router options on the Hono website: https://hono.dev/api/hono#router-option

Metadata

Created: 2023-12-15T02:45:54Z
Modified: 2023-12-15T02:45:54Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-f6gv-hh8j-q8vq/GHSA-f6gv-hh8j-q8vq.json
CWE IDs: ["CWE-94"]
Alternative ID: GHSA-f6gv-hh8j-q8vq
Finding: F422
Auto approve: 1